libheif CVE-2026-32738

Upgrade libheif to version 1.22.0, which resolves the unsigned integer underflow in the Chunk constructor; this is the vendor-released patch confirmed by the GitHub Security Advisory GHSA-7f2h-cmpf-v9ww at https://github.com/strukturag/libheif/security/advisories/GHSA-7f2h-cmpf-v9ww. For deployments where an immediate upgrade is not feasible, implement input validation to reject HEIF/AVIF files with stsc boxes containing samples_per_chunk=0 before passing content to libheif - this blocks the specific malformed file pattern at the cost of adding a preprocessing dependency. For server-side pipelines that automatically process untrusted uploads, sandboxing the libheif decoding process (e.g., via a short-lived subprocess or seccomp-restricted container) will contain crash impact to a single worker rather than the parent service, preserving availability. Note that sandboxing does not fix the vulnerability but limits blast radius. Package maintainers distributing libheif as a shared library (e.g., via apt, dnf, or Homebrew) should track when 1.22.0 reaches their distribution's repositories.