An out-of-bounds read vulnerability in libheif could allow an attacker to cause a denial-of-service or potentially leak sensitive memory content.

This is an Out-of-bounds Read (CWE-125) vulnerability. The flaw occurs during the parsing of HEIF/AVIF image formats, where the decoder fails to properly validate input length, leading to memory access outside of intended bounds.

With a CVSS score of 7.1, this vulnerability poses a significant risk to applications that process image uploads from untrusted users. Exploitation could result in application crashes (Denial of Service) or the exposure of sensitive memory contents, which may be leveraged as part of a larger exploit chain.

Immediate Action: Update the libheif library to version 1.22.0 or later across all dependent systems.

Proactive Monitoring: Check application logs for frequent crashes or errors occurring during image processing tasks.

Compensating Controls: Implement strict input validation or sandboxing for any services that process user-uploaded HEIF/AVIF images to prevent malicious files from reaching the decoder.

Public Exploit Available: Unknown.

Organizations using libraries that rely on libheif for image processing must prioritize updating to version 1.22.0. Given the ubiquity of image processing in modern web applications, ensuring the latest security patches are applied is essential to maintaining system stability and data integrity.