ALAS2023-2026-3314

References: CVE-2026-84384  CVE-2026-84447  CVE-2026-84448 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Fix GHSA-w7mc-p8jc-p853: heap OOB read / info disclosure (Op_YCbCr420_to_RRGGBBaa)

Fix GHSA-9rj8-5mp5-26c9: Out-of-bounds read in RGB→YCbCr identity-matrix colour conversion with mismatched per-channel bit depths

Fix GHSA-4jqm-2x34-6f6r: Heap buffer overflow in SVT-AV1 encoder for high-bit-depth alpha channels

Fix GHSA-x8r2-mggj-j6wr: Heap buffer overflow in `unci` mixed-interleave decoding with unequal chroma bit depths

Fix GHSA-qfj5-c4pq-q998: Out-of-bounds heap read in unc_encoder_rgb_pixel_interleave when an alpha plane is attached to an image whose chroma format carries no alpha (libheif ≤ 1.23.4)

Fix GHSA-qwpf-5wf7-r996: Heap-use-after-free and double free in ImageItem::encode_to_bitstream_and_boxes (shallow copy of ImageDescription::m_tai_timestamp)

Fix GHSA-9c75-9g8r-4728: JPEG 2000 pclr zero-column allocation amplification bypasses max_total_memory

Fix GHSA-r7gr-2xm2-23wf: Heap out-of-bounds read in libheif alpha compositing via mismatched per-channel bit depths (uncompressed codec)

Fix GHSA-7pwf-qh74-p35w: Caller-configured security limits not enforced for MINI-box parsing

Fix GHSA-hvwh-xpj6-ph5x: Error message used after free in heif-enc input loaders

Fix GHSA-q7mw-2fmm-5q94: Out-of-bounds read in libsharpyuv through sample values above the image's bit depth

Fix GHSA-6fqc-p7r8-2g36: CPU amplification: a generically compressed `unci` item is decompressed once per tile

Fix GHSA-h4h8-qgvc-m7r2: OpenJPEG decoder: tile and component counts of a JPEG 2000 codestream cause allocations of several gigabytes regardless of the security limits

Fix GHSA-vv35-6hxg-95x8: Decoded image can have another bit depth than the image handle reports

Fix GHSA-vr5j-9r89-725x: CPU amplification in unci decode path surviving GHSA-24wx-9w62-c96w fix

Fix GHSA-8p2c-9wv4-rx4p: NULL pointer dereference in `Track_Visual::decode_next_image_sample()` when a sequence chunk references a non-visual sample entry

Fix GHSA-3gwx-cjv4-jr74: Reachable assertion when decoding a grid image with an alpha plane of more than 16 bits

Fix GHSA-fcmw-5764-7rq8: Decompressed `unci` tile data escapes the memory budget in the `cmpC` `image_tile` branch

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and overlapping icef units can decompress the same payload repeatedly. HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed in version 1.23.2. (CVE-2026-84384)

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2. (CVE-2026-84447)

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in libheif/api/libheif/heif_regions.cc accepts mask_data_len without verifying that it equals the byte count required by width and height. A later heif_region_get_mask_image() call derives the read length from the region geometry, so an undersized stored buffer causes heif_region_get_inline_mask_image() to read beyond the heap allocation and copy adjacent bytes into the returned monochrome mask image. This can disclose heap data or crash an application that constructs region metadata through the writer API, while the file-parsing path is not affected because it validates the canonical mask size. This issue is fixed in version 1.23.2. (CVE-2026-84448)

Issue Correction:
Run dnf update libheif --releasever 2023.12.20261026 or dnf update --advisory ALAS2023-2026-3314 --releasever 2023.12.20261026 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    libheif-debuginfo-1.23.6-1.amzn2023.aarch64
    libheif-tools-1.23.6-1.amzn2023.aarch64
    libheif-tools-debuginfo-1.23.6-1.amzn2023.aarch64
    heif-pixbuf-loader-1.23.6-1.amzn2023.aarch64
    heif-pixbuf-loader-debuginfo-1.23.6-1.amzn2023.aarch64
    libheif-1.23.6-1.amzn2023.aarch64
    libheif-devel-1.23.6-1.amzn2023.aarch64
    libheif-debugsource-1.23.6-1.amzn2023.aarch64

src:
    libheif-1.23.6-1.amzn2023.src

x86_64:
    libheif-debuginfo-1.23.6-1.amzn2023.x86_64
    libheif-devel-1.23.6-1.amzn2023.x86_64
    heif-pixbuf-loader-debuginfo-1.23.6-1.amzn2023.x86_64
    libheif-tools-debuginfo-1.23.6-1.amzn2023.x86_64
    libheif-1.23.6-1.amzn2023.x86_64
    heif-pixbuf-loader-1.23.6-1.amzn2023.x86_64
    libheif-tools-1.23.6-1.amzn2023.x86_64
    libheif-debugsource-1.23.6-1.amzn2023.x86_64

Changelog:

2026-10-29: The severity of this advisory was changed from medium to important.

2026-10-29: Added descriptions of additional security issues fixed in this update.