libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, Track::init sample timing table() in libheif/sequences/track.cc stores an out-of-bounds chunk index (m chunks.size()) into m presentation timeline when the number of chunks defined in the stco box is less than the number of samples in stsz. A subsequent call to heif track get next raw sequence sample() reads m chunks[chunk idx] with that OOB index, causing a heap-buffer-overflow. Version 1.22.0 fixes the issue.