Heap Use-After-Free and Double Free in libheif ImageItem Encoding (GHSA-qwpf-5wf7-r996)

A heap use-after-free and double-free flaw affects libheif versions 1.21.0 through 1.23.4 during image encoding. Due to shallow copying of ImageDescription::m_tai_timestamp in ImageItem::encode_to_bitstream_and_boxes, temporary object destruction releases the underlying packet prematurely, leaving dangling pointers. Attackers can trigger this remotely via crafted HEIF files with TAI timestamp properties during transcoding, causing denial-of-service aborts or potential memory corruption. Patched in libheif 1.23.5.

libheif is a core dependency for HEIF and AVIF image decoding across servers and desktop utilities; services that accept user-uploaded images and transcode them are susceptible to remote crashes and heap exploitation.