libheif EUVD-2026-30975

Upgrade libheif to version 1.22.0 or later; this is the vendor-confirmed fix, available at https://github.com/strukturag/libheif/releases/tag/v1.22.0. The fix resolves the unbounded loop in Box_stts::get_sample_duration() and is confirmed by both the GitHub release and the GHSA advisory. For deployments that cannot immediately patch, compensating controls include: restricting HEIF file ingestion to authenticated, trusted sources only (reducing the attack surface to internal actors rather than arbitrary internet users); running libheif-based processing in isolated worker processes with CPU time limits (e.g., POSIX RLIMIT_CPU or cgroup cpu.cfs_quota_us) so that an infinite loop is killed automatically by the OS rather than starving the host - note this introduces processing latency and requires restart logic; and rejecting HEIF sequence files (as opposed to still images) at an upstream content-type or magic-bytes filter, since the vulnerable code path is specific to sequence containers. These workarounds carry operational trade-offs (dropped legitimate files, added infrastructure complexity) and are explicitly secondary to patching.