libheif, a HEIF and AVIF file format decoder and encoder, contains an integer overflow or wraparound vulnerability (CWE-190) in versions 1.19.0 through 1.22.x. Specifically, when processing crafted HEIF sequences with the msf1 brand via heif_context_read_from_memory(), the Box_stsz::parse() function applies a maximum frame limit only to variable-size samples, leaving fixed-size samples unchecked for sample_count bounds. Additionally, Track::load() uses 32-bit arithmetic to add current_sample_idx and samples_per_chunk, allowing wraparound that bypasses consistency checks. These unchecked values lead to excessive heap allocations in Chunk::Chunk(), causing potential memory exhaustion and denial of service. The vulnerability is addressed in libheif version 1.23.0.

Exploitation of this vulnerability can cause the affected application to consume excessive amounts of memory, leading to process crashes or stalls due to memory exhaustion. There is no impact on confidentiality or integrity reported, only availability is affected.

Upgrade libheif to version 1.23.0 or later, where this vulnerability is fixed. No other mitigation or workaround is documented. Patch status is not explicitly confirmed beyond the fix in 1.23.0, so users should verify with the vendor advisory for current remediation guidance.