Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-120208: libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | heif-pixbuf-loader | 0:1.23.7-1.amzn2023 |
| Amazon Linux · 2023 | heif-pixbuf-loader-debuginfo | 0:1.23.7-1.amzn2023 |
| Amazon Linux · 2023 | libheif | 0:1.23.7-1.amzn2023 |
| Amazon Linux · 2023 | libheif-debuginfo | 0:1.23.7-1.amzn2023 |
| Amazon Linux · 2023 | libheif-debugsource | 0:1.23.7-1.amzn2023 |
| Amazon Linux · 2023 | libheif-devel | 0:1.23.7-1.amzn2023 |
| Amazon Linux · 2023 | libheif-tools | 0:1.23.7-1.amzn2023 |
| Amazon Linux · 2023 | libheif-tools-debuginfo | 0:1.23.7-1.amzn2023 |
Vulnerabilities 1
-
High 7.5
libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder
libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF fil…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-120208.html