The vulnerability in libheif arises from a mismatch between the dimensions of the primary image plane and the auxiliary alpha plane during decoding and encoding workflows. Specifically, Track_Visual::decode_next_image_sample() does not verify that the auxiliary alpha plane dimensions match the primary frame, leading to inconsistent image data passed to encoding functions. In unc_encoder::encode(), buffer sizing is based on primary dimensions, but copying uses actual plane dimensions, causing out-of-bounds writes or reads when the alpha plane is larger or smaller. This heap corruption vulnerability is addressed in libheif version 1.23.1.

An attacker can craft a malicious HEIF or AVIF image with specific plane dimensions that trigger heap corruption during normal decode and re-encode operations. This can lead to memory corruption affecting confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score is 5.3 (medium severity), reflecting local attack vector, low complexity, no privileges required, user interaction needed, and impacts to confidentiality, integrity, and availability.

Upgrade libheif to version 1.23.1 or later, where this vulnerability is fixed. No other mitigation or workaround is indicated by the vendor advisory.