ALAS2023-2026-3314

References: CVE-2026-84384  CVE-2026-84447  CVE-2026-84448 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and overlapping icef units can decompress the same payload repeatedly. HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed in version 1.23.2. (CVE-2026-84384)

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2. (CVE-2026-84447)

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in libheif/api/libheif/heif_regions.cc accepts mask_data_len without verifying that it equals the byte count required by width and height. A later heif_region_get_mask_image() call derives the read length from the region geometry, so an undersized stored buffer causes heif_region_get_inline_mask_image() to read beyond the heap allocation and copy adjacent bytes into the returned monochrome mask image. This can disclose heap data or crash an application that constructs region metadata through the writer API, while the file-parsing path is not affected because it validates the canonical mask size. This issue is fixed in version 1.23.2. (CVE-2026-84448)

Issue Correction:
Run dnf update libheif --releasever 2023.12.20261026 or dnf update --advisory ALAS2023-2026-3314 --releasever 2023.12.20261026 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    libheif-debuginfo-1.23.6-1.amzn2023.aarch64
    libheif-tools-1.23.6-1.amzn2023.aarch64
    libheif-tools-debuginfo-1.23.6-1.amzn2023.aarch64
    heif-pixbuf-loader-1.23.6-1.amzn2023.aarch64
    heif-pixbuf-loader-debuginfo-1.23.6-1.amzn2023.aarch64
    libheif-1.23.6-1.amzn2023.aarch64
    libheif-devel-1.23.6-1.amzn2023.aarch64
    libheif-debugsource-1.23.6-1.amzn2023.aarch64

src:
    libheif-1.23.6-1.amzn2023.src

x86_64:
    libheif-debuginfo-1.23.6-1.amzn2023.x86_64
    libheif-devel-1.23.6-1.amzn2023.x86_64
    heif-pixbuf-loader-debuginfo-1.23.6-1.amzn2023.x86_64
    libheif-tools-debuginfo-1.23.6-1.amzn2023.x86_64
    libheif-1.23.6-1.amzn2023.x86_64
    heif-pixbuf-loader-1.23.6-1.amzn2023.x86_64
    libheif-tools-1.23.6-1.amzn2023.x86_64
    libheif-debugsource-1.23.6-1.amzn2023.x86_64