The vulnerability in libheif affects versions from 1.19.0 up to but not including 1.23.2. Crafted HEIF or AVIF files with specially constructed mime metadata and unci image data can trigger the decompress_brotli() and do_inflate() functions to produce unbounded output without effective size limits or proper memory accounting. The Brotli decompression path lacks an output bound, and the zlib path only checks a small temporary buffer in a code branch that valid streams do not reach. Additionally, overlapping icef units can cause repeated decompression of the same payload. The HeifContext::interpret_heif_file_images() function processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and cause process termination. The vulnerability is addressed in libheif version 1.23.2.

Exploitation of this vulnerability can lead to denial of service by causing the libheif process to consume unbounded memory and terminate unexpectedly. There is no impact on confidentiality or integrity reported. The CVSS v3.1 score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

A fix is available in libheif version 1.23.2. Users and integrators should upgrade to version 1.23.2 or later to remediate this vulnerability. No other mitigation steps are indicated or required according to the available data.