libheif is a library for HEIF and AVIF image formats. In v1.23.0 and earlier, when a sequence containing a 2×2 primary image plane and a 256×256 auxiliary alpha plane is decoded and subsequently re‑encoded, the library performs a heap allocation based on the primary dimensions but copies the alpha data using its actual plane size. This mismatch causes an out‑of‑bounds write or read on the heap, leading to memory corruption. The corruption could enable an attacker to trigger a crash or, in the worst case, execute arbitrary code if the corruption is exploitable in the context of a privileged process.

The affected product is Struktur AG’s libheif library. Versions up to and including 1.23.0 are vulnerable. The fix was released in libheif 1.23.1. Systems that compile or ship older releases of libheif, particularly those that process HEIF/AVIF images from untrusted input, are at risk.

The CVSS score of 5.3 indicates a moderate severity. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited public exploitation. Exploitation requires delivering or controlling the image data that triggers the encode path, so it primarily represents a local or application‑level risk. An attacker with the ability to supply malicious images to a program that uses libheif could cause a denial of service or, if memory corruption can be chained, remote code execution.