libheif, a HEIF and AVIF image decoder and encoder, contains a heap-buffer-overflow (CWE-787) vulnerability in versions prior to 1.22.0. The flaw arises in the grid tile compositing process when decoding a crafted HEIF/AVIF file with a 1×4 grid of odd-height tiles, enabling an attacker to write 64 bytes past the end of a chroma plane heap allocation. The overflowed data corresponds to chroma pixel values from the malicious tile, granting the attacker full control over the overflow content. This vulnerability is exploitable during normal image decoding with default build configurations. The vulnerability has a CVSS 3.1 score of 8.8, indicating high severity. The issue is resolved in version 1.22.0 of libheif.

Successful exploitation allows an attacker to perform a heap-buffer-overflow write of 64 bytes of attacker-controlled data beyond the allocated buffer for chroma plane pixels during image decoding. This can lead to arbitrary code execution, data corruption, or denial of service. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H). No known exploits are reported in the wild at this time.

Upgrade libheif to version 1.22.0 or later, where this vulnerability is fixed. There is no indication of alternative mitigations or temporary workarounds. Patch status is confirmed fixed in version 1.22.0.