The vulnerability in libheif arises from improper validation of tile component-plane dimensions in the uncompressed codec path. Specifically, heif_context_add_image_tile() accepts independently constructed tiles whose dimensions may not align with the prototype image's tile geometry. The function ImageItem_uncompressed::add_image_tile() forwards this tile to unc_encoder::encode_tile(), which lacks a check_component_sizes() validation. Consequently, unc_encoder_component_interleave::encode_tile() copies data based on the configured tile geometry rather than the actual tile dimensions, allowing an attacker to cause an out-of-bounds write beyond the heap buffer. This memory corruption flaw is resolved in version 1.23.2.

Successful exploitation can lead to memory corruption due to out-of-bounds writes, potentially causing denial of service or arbitrary code execution. The CVSS score of 7.4 reflects a high severity with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts.

Upgrade libheif to version 1.23.2 or later, where this vulnerability is fixed. No other mitigation or workaround is indicated by the vendor advisory. Users should ensure WITH_UNCOMPRESSED_CODEC is updated accordingly.