A vulnerability in the heifer-hevc-dec crate causes a panic when decoding HEVC Range Extensions streams that enable chroma QP offsets but provide an empty offset list. This panic results from an out-of-range access when reading the empty list, aborting the decoding thread or the entire process if built with panic abort. The issue does not cause memory corruption due to the crate's safe Rust codebase. The flaw affects all versions before 0.3.27 and was fixed in version 0.3.27 by treating empty offset lists as zero offsets.