Bug 2539265

Summary:	CVE-2026-84448 libheif: libheif: Information disclosure and denial of service due to heap out-of-bounds read [epel-all]
Product:	[Fedora] Fedora EPEL	Reporter:	Vladimir Vasilev <vvasilev>
Component:	libheif	Assignee:	Michel Lind <michel>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	epel10	CC:	dominik, multimedia-sig, ngompa13
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["6f6beb3e-126c-4e2d-960f-4971ea8c79e1"]}
Fixed In Version:	libheif-1.23.5-4.el10_4 libheif-1.23.5-4.el10_3 libheif-1.23.5-2.el9 libheif-1.23.5-4.el10_2	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-10-03 00:52:11 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2443911, 2538235

Description Vladimir Vasilev 2026-09-23 09:08:39 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in libheif/api/libheif/heif_regions.cc accepts mask_data_len without verifying that it equals the byte count required by width and height. A later heif_region_get_mask_image() call derives the read length from the region geometry, so an undersized stored buffer causes heif_region_get_inline_mask_image() to read beyond the heap allocation and copy adjacent bytes into the returned monochrome mask image. This can disclose heap data or crash an application that constructs region metadata through the writer API, while the file-parsing path is not affected because it validates the canonical mask size. This issue is fixed in version 1.23.2.

Comment 1 Michel Lind 2026-09-24 11:00:48 UTC

This bug is already fixed in a published Bodhi update.

Comment 2 Fedora Update System 2026-09-24 11:01:30 UTC

FEDORA-EPEL-2026-0d891ec3ad (aom-3.13.3-1.el10_3 and libheif-1.23.5-4.el10_3) has been submitted as an update to Fedora EPEL 10.3.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-0d891ec3ad

Comment 3 Fedora Update System 2026-09-24 11:03:20 UTC

FEDORA-EPEL-2026-12b7f6fc6c (aom-3.13.3-1.el9 and libheif-1.23.5-2.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-12b7f6fc6c

Comment 4 Fedora Update System 2026-09-24 11:04:44 UTC

FEDORA-EPEL-2026-18d39b7b8d (aom-3.13.3-1.el10_4 and libheif-1.23.5-4.el10_4) has been submitted as an update to Fedora EPEL 10.4.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-18d39b7b8d

Comment 5 Fedora Update System 2026-09-24 11:04:58 UTC

FEDORA-EPEL-2026-3f535077b3 (aom-3.13.3-1.el10_2 and libheif-1.23.5-4.el10_2) has been submitted as an update to Fedora EPEL 10.2.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-3f535077b3

Comment 6 Fedora Update System 2026-09-25 00:29:10 UTC

FEDORA-EPEL-2026-18d39b7b8d has been pushed to the Fedora EPEL 10.4 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-18d39b7b8d

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2026-09-25 00:39:28 UTC

FEDORA-EPEL-2026-0d891ec3ad has been pushed to the Fedora EPEL 10.3 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-0d891ec3ad

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2026-09-25 00:45:24 UTC

FEDORA-EPEL-2026-12b7f6fc6c has been pushed to the Fedora EPEL 9 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-12b7f6fc6c

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Fedora Update System 2026-09-25 00:51:56 UTC

FEDORA-EPEL-2026-3f535077b3 has been pushed to the Fedora EPEL 10.2 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-3f535077b3

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 10 Fedora Update System 2026-10-03 00:52:11 UTC

FEDORA-EPEL-2026-18d39b7b8d (aom-3.13.3-1.el10_4 and libheif-1.23.5-4.el10_4) has been pushed to the Fedora EPEL 10.4 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 11 Fedora Update System 2026-10-03 01:07:35 UTC

FEDORA-EPEL-2026-0d891ec3ad (aom-3.13.3-1.el10_3 and libheif-1.23.5-4.el10_3) has been pushed to the Fedora EPEL 10.3 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 12 Fedora Update System 2026-10-09 00:32:52 UTC

FEDORA-EPEL-2026-12b7f6fc6c (aom-3.13.3-1.el9 and libheif-1.23.5-2.el9) has been pushed to the Fedora EPEL 9 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 13 Fedora Update System 2026-10-11 00:29:21 UTC

FEDORA-EPEL-2026-3f535077b3 (aom-3.13.3-1.el10_2 and libheif-1.23.5-4.el10_2) has been pushed to the Fedora EPEL 10.2 stable repository.
If problem still persists, please make note of it in this bug report.