libheif is a HEIF and AVIF decoder and encoder. A crafted uncompressed HEIF image using generic zlib unci full‑item compression can trigger an out‑of‑bounds read when the function heif_image_handle_decode_image_tile processes the last advertised tile (4095, 4095). In the libheif/codecs/uncompressed/unc_decoder.cc module, the offset calculation can wrap to zero, bypassing bounds checking and causing memcpy to use an invalid pointer with a one‑terabyte length. The result is a process crash, identified as a CWE‑125 overflow. Opening the file alone does not trigger the issue; tile decoding is required. This issue is fixed in version 1.23.1.

The vulnerability affects the libheif library distributed by strukturag. Versions from 1.19.0 through 1.23.1 are affected; the fix is included in 1.23.1 onward.

The CVSS score of 8.7 indicates high severity. No EPSS score is available and the issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a malicious HEIF file to an application that decodes the final tile, typically via heif_image_handle_decode_image_tile. Because the fault only causes a crash, the main risk is denial of service rather than code execution, but it can impact services that rely on HEIF processing.