ALAS2027-2026-228

References: CVE-2026-84447  CVE-2026-84384  CVE-2026-84448  CVE-2026-84444  CVE-2026-84446 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Package updates are available for Amazon Linux 2027 that fix the following vulnerabilities:
CVE-2026-84448:
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in libheif/api/libheif/heif_regions.cc accepts mask_data_len without verifying that it equals the byte count required by width and height. A later heif_region_get_mask_image() call derives the read length from the region geometry, so an undersized stored buffer causes heif_region_get_inline_mask_image() to read beyond the heap allocation and copy adjacent bytes into the returned monochrome mask image. This can disclose heap data or crash an application that constructs region metadata through the writer API, while the file-parsing path is not affected because it validates the canonical mask size. This issue is fixed in version 1.23.2.

CVE-2026-84447:
libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2.

CVE-2026-84446:
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::init_sample_timing_table() compute a logical m_num_output_samples value that exceeds the uint32_t counters used by Track_Visual::decode_next_image_sample() and Track::get_next_sample_raw_data(). The resulting comparison can never reach the oversized output count, causing non-terminating decode or raw-sample loops and bypassing max_sequence_frames. The same sequence path repeatedly calls Box_stts::get_sample_duration() and allocates Chunk::m_sample_ranges and Track::m_presentation_timeline outside MemoryHandle accounting, allowing severe CPU and memory exhaustion from a small file. This issue is fixed in version 1.23.2.

CVE-2026-84444:
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image. ImageItem_uncompressed::add_image_tile() passes that tile directly to unc_encoder::encode_tile(), which lacked the check_component_sizes() gate and sizes its output from the configured tile geometry while copying the tile's actual component-plane dimensions. An oversized component plane can therefore make unc_encoder_component_interleave::encode_tile() copy attacker-controlled data beyond the heap output buffer. This issue is fixed in version 1.23.2.

CVE-2026-84384:
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and overlapping icef units can decompress the same payload repeatedly. HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed in version 1.23.2.

Issue Correction:
Run dnf update libheif --releasever 2027.0.20261026 or dnf update --advisory ALAS2027-2026-228 --releasever 2027.0.20261026 to update your system.

New Packages:

aarch64:
    libheif-debuginfo-1.23.6-1.amzn2027.aarch64
    libheif-devel-1.23.6-1.amzn2027.aarch64
    libheif-tools-debuginfo-1.23.6-1.amzn2027.aarch64
    libheif-1.23.6-1.amzn2027.aarch64
    libheif-tools-1.23.6-1.amzn2027.aarch64
    libheif-debugsource-1.23.6-1.amzn2027.aarch64

src:
    libheif-1.23.6-1.amzn2027.src

x86_64:
    libheif-tools-debuginfo-1.23.6-1.amzn2027.x86_64
    libheif-debuginfo-1.23.6-1.amzn2027.x86_64
    libheif-debugsource-1.23.6-1.amzn2027.x86_64
    libheif-devel-1.23.6-1.amzn2027.x86_64
    libheif-1.23.6-1.amzn2027.x86_64
    libheif-tools-1.23.6-1.amzn2027.x86_64