libheif is a library for decoding and encoding HEIF and AVIF file formats. Versions before 1.22.1 contain a vulnerability where the uncompressed HEIF decoder validates compressed-unit offsets by adding unit_offset and unit_size without proper overflow checks. This addition can wrap around, allowing a crafted HEIF file to bypass range checks and cause the construction of a vector from iterators outside the compressed item buffer. This results in an out-of-bounds heap read and potential crash. The vulnerability is identified as CWE-125 (Out-of-bounds Read) and is addressed in libheif version 1.22.1.

An attacker can craft a malicious HEIF file that triggers an out-of-bounds heap read in vulnerable versions of libheif. This can lead to application crashes (denial of service). There is no indication of confidentiality or integrity impact. The CVSS 3.1 base score is 6.5 (medium severity) with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, and high availability impact.

Upgrade libheif to version 1.22.1 or later, where this vulnerability is patched. No other mitigation or temporary workaround is indicated. Users should ensure they do not process untrusted HEIF files with vulnerable versions.