Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-84451: Incomplete fix for GHSA-73p7-m7gg-w2jv leaves libheif 1.23.1 vulnerable to an out-of-bounds read NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-hh47-fhqr-cj2r CVE-2026-84450: Incomplete fix for GHSA-73p7-m7gg-w2jv leaves libheif 1.23.1 vulnerable to an out-of-bounds read NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-hh47-fhqr-cj2r
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | heif-pixbuf-loader | 0:1.23.4-1.amzn2023 |
| Amazon Linux · 2023 | heif-pixbuf-loader-debuginfo | 0:1.23.4-1.amzn2023 |
| Amazon Linux · 2023 | libheif | 0:1.23.4-1.amzn2023 |
| Amazon Linux · 2023 | libheif-debuginfo | 0:1.23.4-1.amzn2023 |
| Amazon Linux · 2023 | libheif-debugsource | 0:1.23.4-1.amzn2023 |
| Amazon Linux · 2023 | libheif-devel | 0:1.23.4-1.amzn2023 |
| Amazon Linux · 2023 | libheif-tools | 0:1.23.4-1.amzn2023 |
| Amazon Linux · 2023 | libheif-tools-debuginfo | 0:1.23.4-1.amzn2023 |
Vulnerabilities 2
-
Medium 6.5
libheif: Incomplete fix for CVE-2026-62292 leaves libheif vulnerable to an out-of-bounds read
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of unc_decoder::get_compressed_image_data_uncompressed() in libheif/codecs/uncompressed/unc_decoder.cc retains an addition-based range check tha…
-
Medium 4.3
libheif: `clap` + oversized `ispe` aborts on an assert in `Fraction::Fraction` (incomplete fix for CVE-2026-62289)
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32_MAX + 1 can reach crop calculations through heif_image_handle_get_image_tiling…