libheif, a popular HEIF/AVIF decoder and encoder, contains an unbounded heap allocation flaw. The sequence parser fails to enforce a limit on sample_count when the HEIF sequence is in fixed‑size mode, allowing an image crafted with the msf1 brand to instruct the library to allocate gigabytes of memory. The overflow can cause the process to crash or stall due to memory exhaustion. The weakness is identified as an integer overflow (CWE‑190) and an unbounded array allocation (CWE‑770).

The vulnerability affects strukturag libheif versions from 1.19.0 up to, but not including, 1.23.0. Applications or services that integrate these library versions and process untrusted HEIF files are potentially impacted. Versions 1.23.0 and later contain the fix and are not affected.

The CVSS score is 7.5, indicating a highly severe impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by supplying a carefully crafted HEIF file with a malicious sample_count and msf1 brand. The exploit requires the target to successfully parse such a file, which can be achieved in any context where the application accepts or decodes HEIF images from external sources. The exploit is local to the process running libheif but can lead to a denial of service or potential system instability through uncontrolled memory consumption.