A vulnerability in the heifer-hevc-dec Rust crate allows a crafted HEVC stream to cause a panic during decoding by redefining tile layouts that do not match the active sequence parameter set (SPS). This leads to an out-of-bounds indexing panic, aborting the decoding thread or process. The issue is fixed in version 0.3.27 by rejecting invalid tile layouts at decode time.