libheif, a HEIF and AVIF file format decoder and encoder, contains an integer overflow or wraparound vulnerability (CWE-190) in versions 1.19.0 up to but not including 1.23.0. Specifically, when processing a crafted HEIF sequence with the msf1 brand via heif_context_read_from_memory(), the Box_stsz::parse() function applies max_sequence_frames only to variable-size samples, allowing an attacker-controlled sample_count in fixed-size mode without bounds. Additionally, Track::load() uses 32-bit arithmetic to add current_sample_idx and samples_per_chunk, enabling bypass of consistency checks through wraparound. These incorrect calculations lead to excessive memory allocation in Chunk::Chunk(), causing potential gigabyte-scale heap allocations that can crash or stall the process due to memory exhaustion. The vulnerability is addressed in libheif version 1.23.0.

Exploitation of this vulnerability can cause a denial of service by exhausting system memory, crashing, or stalling the affected process. There is no indication of confidentiality or integrity impact. The CVSS score of 7.5 reflects a high severity denial-of-service impact with no privileges or user interaction required.

Upgrade libheif to version 1.23.0 or later, where this vulnerability is fixed. No other mitigation or workaround is indicated by the vendor advisory.