The vulnerability in libheif (CVE-2026-41071) arises from improper validation of sample counts in the saiz box of HEIF files. Specifically, the SampleAuxInfoReader constructor iterates over the number of samples declared by saiz without verifying that this number matches the actual number of chunks available. When saiz declares more samples than the chunks vector contains, the code reads out-of-bounds, causing a heap-buffer-overflow. This occurs during the heif_context_read_from_file function call when parsing a crafted HEIF file. Applications using libheif to process untrusted HEIF files are affected. The issue is resolved in libheif version 1.22.0.

An attacker can cause a heap-buffer-overflow by supplying a specially crafted HEIF file, potentially leading to application crashes or other undefined behavior. The vulnerability requires no privileges and no user interaction beyond opening the malicious file. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, no privileges required, and low impact on confidentiality, integrity, and availability.

This vulnerability has been fixed in libheif version 1.22.0. Users and developers should upgrade to version 1.22.0 or later to remediate this issue. Since this is a library vulnerability, applications using libheif should update their dependencies accordingly. No vendor advisory content is provided to indicate alternative mitigations or that no action is required.