Amazon Linux 2023 : heif-pixbuf-loader, libheif, libheif-devel (ALAS2023-2026-3314)

medium Nessus Plugin ID 371847

Language:

Synopsis

The remote Amazon Linux 2023 host is missing a security update.

Description

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3314 advisory.

Fix GHSA-w7mc-p8jc-p853: heap OOB read / info disclosure (Op_YCbCr420_to_RRGGBBaa)

Fix GHSA-9rj8-5mp5-26c9: Out-of-bounds read in RGBYCbCr identity-matrix colour conversion with mismatched per-channel bit depths

Fix GHSA-4jqm-2x34-6f6r: Heap buffer overflow in SVT-AV1 encoder for high-bit-depth alpha channels

Fix GHSA-x8r2-mggj-j6wr: Heap buffer overflow in `unci` mixed-interleave decoding with unequal chroma bit depths

Fix GHSA-qfj5-c4pq-q998: Out-of-bounds heap read in unc_encoder_rgb_pixel_interleave when an alpha plane is attached to an image whose chroma format carries no alpha (libheif 1.23.4)

Fix GHSA-qwpf-5wf7-r996: Heap-use-after-free and double free in ImageItem::encode_to_bitstream_and_boxes (shallow copy of ImageDescription::m_tai_timestamp)

Fix GHSA-9c75-9g8r-4728: JPEG 2000 pclr zero-column allocation amplification bypasses max_total_memory

Fix GHSA-r7gr-2xm2-23wf: Heap out-of-bounds read in libheif alpha compositing via mismatched per-channel bit depths (uncompressed codec)

Fix GHSA-7pwf-qh74-p35w: Caller-configured security limits not enforced for MINI-box parsing

Fix GHSA-hvwh-xpj6-ph5x: Error message used after free in heif-enc input loaders

Fix GHSA-q7mw-2fmm-5q94: Out-of-bounds read in libsharpyuv through sample values above the image's bit depth

Fix GHSA-6fqc-p7r8-2g36: CPU amplification: a generically compressed `unci` item is decompressed once per tile

Fix GHSA-h4h8-qgvc-m7r2: OpenJPEG decoder: tile and component counts of a JPEG 2000 codestream cause allocations of several gigabytes regardless of the security limits

Fix GHSA-vv35-6hxg-95x8: Decoded image can have another bit depth than the image handle reports

Fix GHSA-vr5j-9r89-725x: CPU amplification in unci decode path surviving GHSA-24wx-9w62-c96w fix

Fix GHSA-8p2c-9wv4-rx4p: NULL pointer dereference in `Track_Visual::decode_next_image_sample()` when a sequence chunk references a non-visual sample entry

Fix GHSA-3gwx-cjv4-jr74: Reachable assertion when decoding a grid image with an alpha plane of more than 16 bits

Fix GHSA-fcmw-5764-7rq8: Decompressed `unci` tile data escapes the memory budget in the `cmpC` `image_tile` branch

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and overlapping icef units can decompress the same payload repeatedly.
HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed in version 1.23.2. (CVE-2026-84384)

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2.
(CVE-2026-84447)

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in libheif/api/libheif/heif_regions.cc accepts mask_data_len without verifying that it equals the byte count required by width and height. A later heif_region_get_mask_image() call derives the read length from the region geometry, so an undersized stored buffer causes heif_region_get_inline_mask_image() to read beyond the heap allocation and copy adjacent bytes into the returned monochrome mask image. This can disclose heap data or crash an application that constructs region metadata through the writer API, while the file-parsing path is not affected because it validates the canonical mask size. This issue is fixed in version 1.23.2.
(CVE-2026-84448)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'dnf update libheif --releasever 2023.12.20261026' or or 'dnf update --advisory ALAS2023-2026-3314 --releasever 2023.12.20261026' to update your system.

Plugin Details

Severity: Medium

ID: 371847

File Name: al2023_ALAS2023-2026-3314.nasl

Version: 1.4

Type: Local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 10/25/2026

Updated: 11/2/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.61

CVSS v2

Risk Factor: Low

Base Score: 2.6

Temporal Score: 1.9

Vector: CVSS2#AV:L/AC:H/Au:N/C:P/I:N/A:P

CVSS Score Source: CVE-2026-84448

CVSS v3

Risk Factor: Medium

Base Score: 4

Temporal Score: 3.5

Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:amazon:linux:2023, p-cpe:/a:amazon:linux:heif-pixbuf-loader-debuginfo, p-cpe:/a:amazon:linux:heif-pixbuf-loader, p-cpe:/a:amazon:linux:libheif-debuginfo, p-cpe:/a:amazon:linux:libheif-debugsource, p-cpe:/a:amazon:linux:libheif-devel, p-cpe:/a:amazon:linux:libheif-tools-debuginfo, p-cpe:/a:amazon:linux:libheif-tools, p-cpe:/a:amazon:linux:libheif

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/24/2026

Vulnerability Publication Date: 9/18/2026

Reference Information

CVE: CVE-2026-84384, CVE-2026-84447, CVE-2026-84448

IAVB: 2026-B-0281

Detections

Analytics