A crafted HEIF or AVIF file that contains a clean aperture box can be processed by libheif to create an image dimension of zero, which triggers an integer underflow in the Fraction constructor when the clean aperture transformation is applied twice. The underflow generates an invalid fraction value that causes a debug build to assert and abort, or a release build to produce a corrupt crop and a zero‑width tiling result. The result is an application crash or delivery of corrupted image data, which effectively constitutes a denial of service.

The vulnerability is present in the libheif decoder and encoder library from the vendor strukturag for all releases up to and including version 1.23.0. Versions 1.23.1 and newer contain the fix.

The CVSS score is 4.3, indicating a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The flaw is triggered by parsing a maliciously crafted media file, so the attacker needs to supply such a file to an application that uses libheif. Because the issue is local to file processing, exposure is limited to environments that accept external HEIF or AVIF content.