Bug 2537079

The Fedora 43 and Fedora 44 `libheif` packages appear to be behind multiple upstream security fixes that are already being tracked by Red Hat Product Security.

Current Fedora packages:

* Fedora 43: `libheif-1.20.2-6.fc43`
* Fedora 44: `libheif-1.21.2-1.fc44`

Multiple Red Hat Product Security trackers explicitly identify versions including Fedora's current 1.20.x/1.21.2 packages as affected.

Examples include:

* CVE-2026-32740 — Red Hat Bug 2479969
  Affects `libheif` 1.21.2 and earlier; upstream fix in 1.22.0.

* CVE-2026-32741 — Red Hat Bug 2480002
  Affects versions through 1.21.2; upstream fix in 1.22.0.

* CVE-2026-32814 — Red Hat Bug 2480001
  Affects versions through 1.21.2; upstream fix in 1.22.0.

* CVE-2026-47178 — Red Hat Bug 2505925
  Explicitly affects `libheif` 1.19.0 through 1.21.2; upstream fix in 1.22.0. This vulnerability involves an out-of-bounds write in the uncompressed (`unci`) tile decoder.

* CVE-2026-48029 — Red Hat Bug 2506506
  Affects `libheif` versions through 1.21.2; upstream fix in 1.22.0.

The current Fedora package information shows Fedora 43 and Fedora 44 remaining on the versions above, while Fedora 45 has moved to a substantially newer `libheif` release.

I also reviewed the upstream `libheif` security advisories and the HEIF Heist research, which document additional security issues and continued security fixes in subsequent upstream releases.

I am not filing this as a new CVE or attempting to duplicate the existing Red Hat Product Security reports. The purpose of this report is to request review of the Fedora 43/44 package status and determine whether the applicable security fixes have been backported into the existing packages.

Please verify whether the relevant fixes from the Red Hat Product Security trackers above have been incorporated into the Fedora 43/44 packages. If they have not been backported, please determine whether updated Fedora 43/44 packages should be provided.

References:

Red Hat Product Security:

CVE-2026-32740 — https://bugzilla.redhat.com/show_bug.cgi?id=2479969
CVE-2026-32741 — https://bugzilla.redhat.com/show_bug.cgi?id=2480002
CVE-2026-32814 — https://bugzilla.redhat.com/show_bug.cgi?id=2480001
CVE-2026-47178 — https://bugzilla.redhat.com/show_bug.cgi?id=2505925
CVE-2026-48029 — https://bugzilla.redhat.com/show_bug.cgi?id=2506506

Upstream libheif security advisories:
https://github.com/strukturag/libheif/security/advisories

Fedora libheif package:
https://packages.fedoraproject.org/pkgs/libheif/libheif/

HEIF Heist:
https://heif-heist.com/


Reproducible: Didn't try

Actual Results:
The currently published Fedora packages are:

Fedora 43: libheif-1.20.2-6.fc43
Fedora 44: libheif-1.21.2-1.fc44

Red Hat Product Security has multiple libheif vulnerability trackers whose affected-version ranges include these versions.

For example:

CVE-2026-32740 (Red Hat Bug 2479969): affected through 1.21.2; fixed upstream in 1.22.0.
CVE-2026-32741 (Red Hat Bug 2480002): affected through 1.21.2; fixed upstream in 1.22.0.
CVE-2026-32814 (Red Hat Bug 2480001): affected through 1.21.2; fixed upstream in 1.22.0.
CVE-2026-47178 (Red Hat Bug 2505925): affected 1.19.0 through 1.21.2; fixed upstream in 1.22.0.
CVE-2026-48029 (Red Hat Bug 2506506): affected 1.19.0 through 1.21.2; fixed upstream in 1.22.0.

I have not found a newer Fedora 43 or Fedora 44 libheif build corresponding to these fixes. Fedora 45 and newer, however, have moved to substantially newer libheif releases.

I have not independently established that no individual security patches have been backported into the Fedora 43/44 packages, so I am requesting maintainer/security-team review rather than asserting that every listed CVE is definitively exploitable in the Fedora builds.

Expected Results:
Fedora 43 and Fedora 44 should provide libheif packages containing the applicable upstream security fixes, either through an updated upstream version or documented backports of the required patches.

At minimum, the Fedora packages should not remain vulnerable to the issues already identified by Red Hat Product Security as affecting libheif versions 1.20.2 and 1.21.2.

The applicable Red Hat Product Security trackers should be associated with the corresponding Fedora updates so that Fedora users receive the security fixes through the normal update mechanism.

Additional Information:
This report is not intended to duplicate the existing Red Hat Product Security CVE trackers. Those trackers are cited because they establish the affected upstream version ranges and the corresponding upstream fixes.

The concern is the Fedora 43/44 package status and whether the required fixes have been incorporated into those branches.

Relevant Red Hat Product Security tracking bugs:

CVE-2026-32740 — Bug 2479969
CVE-2026-32741 — Bug 2480002
CVE-2026-32814 — Bug 2480001
CVE-2026-47178 — Bug 2505925
CVE-2026-48029 — Bug 2506506
CVE-2026-47709 — Bug 2506070
CVE-2026-49271 — Bug 2494766

The upstream libheif project has continued releasing security fixes after the versions currently shipped in Fedora 43/44.

HEIF Heist also documents a broader set of security issues affecting HEIF/AVIF parsing. I am including it as supporting background, not as a request for a new CVE.

References:

Red Hat Product Security:
https://bugzilla.redhat.com/show_bug.cgi?id=2479969
https://bugzilla.redhat.com/show_bug.cgi?id=2480002
https://bugzilla.redhat.com/show_bug.cgi?id=2480001
https://bugzilla.redhat.com/show_bug.cgi?id=2505925
https://bugzilla.redhat.com/show_bug.cgi?id=2506506

Upstream libheif security advisories:
https://github.com/strukturag/libheif/security/advisories

Fedora libheif package:
https://packages.fedoraproject.org/pkgs/libheif/libheif/

HEIF Heist:
https://heif-heist.com/