A crafted HEIF or AVIF file containing a clean aperture box can be processed by libheif to create an image dimension of zero. When such a file is parsed, the library first returns already transformed dimensions from ImageItem::get_heif_image_tiling(), and the subsequent call to process_image_transformations_on_tiling() applies the clean aperture transformation a second time. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows, creating a Fraction with a numerator of 0xFFFFFFFF and a denominator of 2. In debug builds this triggers an assertion and aborts; in release builds the corrupt crop leads to a zero‑width tiling result. The outcome is an application crash or delivery of corrupted image data, constituting a denial‑of‑service scenario.

The vulnerability is present in the libheif decoder and encoder library from the vendor strukturag for all releases up to and including version 1.23.0. Versions 1.23.1 and newer contain the fix.

The CVSS score is 4.3, indicating a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The flaw is triggered by parsing a maliciously crafted media file, so the attacker needs to supply such a file to an application that uses libheif. Because the issue is local to file processing, exposure is limited to environments that accept external HEIF or AVIF content.