The vulnerability in libheif affects versions from 1.19.0 up to but not including 1.23.3. A crafted image item containing a clap property and an ispe width or height exceeding INT32_MAX + 1 can trigger crop calculations via heif_image_handle_get_image_tiling(). The Box_clap::left_rounded() or Box_clap::top_rounded() functions pass the image dimension minus one to Fraction::Fraction(), whose uint32_t constructor uses an assertion for input validation. This causes assertion failures in builds with assertions enabled, aborting the process. In release builds without assertions, invalid crop geometry may be computed, and the tiling API returns dimensions that bypass normal decode security limits. The vulnerability is addressed in libheif version 1.23.3.

In assert-enabled builds, the vulnerability causes an application abort due to assertion failure, resulting in denial of service. In release builds, it can lead to invalid crop geometry calculations and tiling API responses that bypass normal decode security limits. There is no impact on confidentiality or integrity, only availability is affected. No known exploits are reported in the wild.

Upgrade libheif to version 1.23.3 or later, where this vulnerability is fixed. No other mitigation is indicated by the vendor advisory.