Bug 2494766

Summary: CVE-2026-49271 libheif: libheif: Denial of Service via crafted HEIF file due to integer wrap-around [fedora-all]
Product: [Fedora] Fedora Reporter: Srikanth Balasubramanian <sbalasub>
Component: libheifAssignee: Neal Gompa <ngompa13>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: 45CC: dominik, multimedia-sig, ngompa13
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["2b57254b-dc2a-46f8-868f-93357690ca44"]}
Fixed In Version: libheif-1.23.5-3.fc45 libheif-1.23.5-3.fc44 libheif-1.23.5-3.fc43 Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-09-24 00:19:09 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2490846    

Description Srikanth Balasubramanian 2026-06-30 06:39:37 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unit_offset + unit_size. Because the addition can wrap, a crafted HEIF file can pass the range check and then construct a vector from iterators outside the compressed item buffer, producing an out-of-bounds heap read and crash. Version 1.22.1 patches the issue.

Comment 1 Fedora Update System 2026-08-10 17:21:11 UTC
FEDORA-2026-26ae66c60f (darktable-5.4.1-12.fc45, digikam-9.1.0-3.fc45, and 25 more) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-26ae66c60f

Comment 2 Fedora Update System 2026-08-12 19:38:27 UTC
FEDORA-2026-823e06dfcf (darktable-5.4.1-12.fc45, digikam-9.1.0-3.fc45, and 25 more) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-823e06dfcf

Comment 3 Fedora Update System 2026-08-12 19:40:43 UTC
FEDORA-2026-b8ff7153f1 (darktable-5.4.1-12.fc46, digikam-9.1.0-3.fc46, and 25 more) has been submitted as an update to Fedora 46.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-b8ff7153f1

Comment 4 Fedora Update System 2026-08-15 11:50:38 UTC
FEDORA-2026-823e06dfcf (darktable-5.4.1-12.fc45, digikam-9.1.0-3.fc45, and 25 more) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 5 Fedora Update System 2026-08-15 11:51:09 UTC
FEDORA-2026-b8ff7153f1 (darktable-5.4.1-12.fc46, digikam-9.1.0-3.fc46, and 25 more) has been pushed to the Fedora 46 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 6 Aoife Moloney 2026-08-17 15:06:28 UTC
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.

Comment 7 Fedora Update System 2026-09-02 12:27:34 UTC
FEDORA-2026-a7307e699c (libheif-1.23.3-2.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-a7307e699c

Comment 8 Fedora Update System 2026-09-22 23:42:33 UTC
FEDORA-2026-cfdbb8b2f0 (libheif-1.23.5-3.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-cfdbb8b2f0

Comment 9 Fedora Update System 2026-09-22 23:42:49 UTC
FEDORA-2026-022ff83e3e (libheif-1.23.5-3.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-022ff83e3e

Comment 10 Fedora Update System 2026-09-22 23:43:07 UTC
FEDORA-2026-78461b38b3 (libheif-1.23.5-3.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-78461b38b3

Comment 11 Fedora Update System 2026-09-23 01:44:58 UTC
FEDORA-2026-78461b38b3 has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-78461b38b3`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-78461b38b3

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 12 Fedora Update System 2026-09-23 02:03:43 UTC
FEDORA-2026-cfdbb8b2f0 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-cfdbb8b2f0`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-cfdbb8b2f0

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 13 Fedora Update System 2026-09-23 02:29:07 UTC
FEDORA-2026-022ff83e3e has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-022ff83e3e`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-022ff83e3e

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 14 Fedora Update System 2026-09-24 00:19:09 UTC
FEDORA-2026-78461b38b3 (libheif-1.23.5-3.fc45) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 15 Fedora Update System 2026-09-26 01:23:06 UTC
FEDORA-2026-cfdbb8b2f0 (libheif-1.23.5-3.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 16 Fedora Update System 2026-09-26 01:30:44 UTC
FEDORA-2026-022ff83e3e (libheif-1.23.5-3.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.