Amazon Linux 2023 Security Advisory: ALAS2023-2026-3437
Advisory Released Date: 2026-11-12
Advisory Updated Date: 2026-11-12
Severity:
Important
Issue Overview:
libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines. (CVE-2026-120208)
Affected Packages:
libheif
Issue Correction:
Run dnf update libheif --releasever 2023.12.20261112 or dnf update --advisory ALAS2023-2026-3437 --releasever 2023.12.20261112 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
aarch64:
libheif-debuginfo-1.23.7-1.amzn2023.aarch64
libheif-devel-1.23.7-1.amzn2023.aarch64
libheif-tools-debuginfo-1.23.7-1.amzn2023.aarch64
heif-pixbuf-loader-1.23.7-1.amzn2023.aarch64
libheif-tools-1.23.7-1.amzn2023.aarch64
heif-pixbuf-loader-debuginfo-1.23.7-1.amzn2023.aarch64
libheif-debugsource-1.23.7-1.amzn2023.aarch64
libheif-1.23.7-1.amzn2023.aarch64
src:
libheif-1.23.7-1.amzn2023.src
x86_64:
libheif-debuginfo-1.23.7-1.amzn2023.x86_64
libheif-tools-debuginfo-1.23.7-1.amzn2023.x86_64
heif-pixbuf-loader-1.23.7-1.amzn2023.x86_64
heif-pixbuf-loader-debuginfo-1.23.7-1.amzn2023.x86_64
libheif-1.23.7-1.amzn2023.x86_64
libheif-devel-1.23.7-1.amzn2023.x86_64
libheif-tools-1.23.7-1.amzn2023.x86_64
libheif-debugsource-1.23.7-1.amzn2023.x86_64