Fedora Account System
Red Hat Associate
Red Hat Customer
The Fedora 43 and Fedora 44 `libheif` packages appear to be behind multiple upstream security fixes that are already being tracked by Red Hat Product Security. Current Fedora packages: * Fedora 43: `libheif-1.20.2-6.fc43` * Fedora 44: `libheif-1.21.2-1.fc44` Multiple Red Hat Product Security trackers explicitly identify versions including Fedora's current 1.20.x/1.21.2 packages as affected. Examples include: * CVE-2026-32740 — Red Hat Bug 2479969 Affects `libheif` 1.21.2 and earlier; upstream fix in 1.22.0. * CVE-2026-32741 — Red Hat Bug 2480002 Affects versions through 1.21.2; upstream fix in 1.22.0. * CVE-2026-32814 — Red Hat Bug 2480001 Affects versions through 1.21.2; upstream fix in 1.22.0. * CVE-2026-47178 — Red Hat Bug 2505925 Explicitly affects `libheif` 1.19.0 through 1.21.2; upstream fix in 1.22.0. This vulnerability involves an out-of-bounds write in the uncompressed (`unci`) tile decoder. * CVE-2026-48029 — Red Hat Bug 2506506 Affects `libheif` versions through 1.21.2; upstream fix in 1.22.0. The current Fedora package information shows Fedora 43 and Fedora 44 remaining on the versions above, while Fedora 45 has moved to a substantially newer `libheif` release. I also reviewed the upstream `libheif` security advisories and the HEIF Heist research, which document additional security issues and continued security fixes in subsequent upstream releases. I am not filing this as a new CVE or attempting to duplicate the existing Red Hat Product Security reports. The purpose of this report is to request review of the Fedora 43/44 package status and determine whether the applicable security fixes have been backported into the existing packages. Please verify whether the relevant fixes from the Red Hat Product Security trackers above have been incorporated into the Fedora 43/44 packages. If they have not been backported, please determine whether updated Fedora 43/44 packages should be provided. References: Red Hat Product Security: CVE-2026-32740 — https://bugzilla.redhat.com/show_bug.cgi?id=2479969 CVE-2026-32741 — https://bugzilla.redhat.com/show_bug.cgi?id=2480002 CVE-2026-32814 — https://bugzilla.redhat.com/show_bug.cgi?id=2480001 CVE-2026-47178 — https://bugzilla.redhat.com/show_bug.cgi?id=2505925 CVE-2026-48029 — https://bugzilla.redhat.com/show_bug.cgi?id=2506506 Upstream libheif security advisories: https://github.com/strukturag/libheif/security/advisories Fedora libheif package: https://packages.fedoraproject.org/pkgs/libheif/libheif/ HEIF Heist: https://heif-heist.com/ Reproducible: Didn't try Actual Results: The currently published Fedora packages are: Fedora 43: libheif-1.20.2-6.fc43 Fedora 44: libheif-1.21.2-1.fc44 Red Hat Product Security has multiple libheif vulnerability trackers whose affected-version ranges include these versions. For example: CVE-2026-32740 (Red Hat Bug 2479969): affected through 1.21.2; fixed upstream in 1.22.0. CVE-2026-32741 (Red Hat Bug 2480002): affected through 1.21.2; fixed upstream in 1.22.0. CVE-2026-32814 (Red Hat Bug 2480001): affected through 1.21.2; fixed upstream in 1.22.0. CVE-2026-47178 (Red Hat Bug 2505925): affected 1.19.0 through 1.21.2; fixed upstream in 1.22.0. CVE-2026-48029 (Red Hat Bug 2506506): affected 1.19.0 through 1.21.2; fixed upstream in 1.22.0. I have not found a newer Fedora 43 or Fedora 44 libheif build corresponding to these fixes. Fedora 45 and newer, however, have moved to substantially newer libheif releases. I have not independently established that no individual security patches have been backported into the Fedora 43/44 packages, so I am requesting maintainer/security-team review rather than asserting that every listed CVE is definitively exploitable in the Fedora builds. Expected Results: Fedora 43 and Fedora 44 should provide libheif packages containing the applicable upstream security fixes, either through an updated upstream version or documented backports of the required patches. At minimum, the Fedora packages should not remain vulnerable to the issues already identified by Red Hat Product Security as affecting libheif versions 1.20.2 and 1.21.2. The applicable Red Hat Product Security trackers should be associated with the corresponding Fedora updates so that Fedora users receive the security fixes through the normal update mechanism. Additional Information: This report is not intended to duplicate the existing Red Hat Product Security CVE trackers. Those trackers are cited because they establish the affected upstream version ranges and the corresponding upstream fixes. The concern is the Fedora 43/44 package status and whether the required fixes have been incorporated into those branches. Relevant Red Hat Product Security tracking bugs: CVE-2026-32740 — Bug 2479969 CVE-2026-32741 — Bug 2480002 CVE-2026-32814 — Bug 2480001 CVE-2026-47178 — Bug 2505925 CVE-2026-48029 — Bug 2506506 CVE-2026-47709 — Bug 2506070 CVE-2026-49271 — Bug 2494766 The upstream libheif project has continued releasing security fixes after the versions currently shipped in Fedora 43/44. HEIF Heist also documents a broader set of security issues affecting HEIF/AVIF parsing. I am including it as supporting background, not as a request for a new CVE. References: Red Hat Product Security: https://bugzilla.redhat.com/show_bug.cgi?id=2479969 https://bugzilla.redhat.com/show_bug.cgi?id=2480002 https://bugzilla.redhat.com/show_bug.cgi?id=2480001 https://bugzilla.redhat.com/show_bug.cgi?id=2505925 https://bugzilla.redhat.com/show_bug.cgi?id=2506506 Upstream libheif security advisories: https://github.com/strukturag/libheif/security/advisories Fedora libheif package: https://packages.fedoraproject.org/pkgs/libheif/libheif/ HEIF Heist: https://heif-heist.com/
Fedora Linux 44 reports libheif-1.23.4-6.fc44.x86_64 as available through dnf list libheif on my machine.
Yes, it looks like they just updated/released the FC44 package to 1.23.4-6 over the weekend. I had to manually rpme -e --nodeps the old version for it to be able to see the update which I thought was odd.
FEDORA-2026-8c900fbe64 (libheif-1.23.6-1.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-8c900fbe64
FEDORA-2026-0ba06812ef (libheif-1.23.6-1.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-0ba06812ef
FEDORA-EPEL-2026-0be17bf6a6 (libheif-1.23.6-1.el10_2) has been submitted as an update to Fedora EPEL 10.2. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-0be17bf6a6
FEDORA-EPEL-2026-ec3c522676 (libheif-1.23.6-1.el10_4) has been submitted as an update to Fedora EPEL 10.4. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-ec3c522676
FEDORA-EPEL-2026-3ffce94552 (libheif-1.23.6-1.el10_3) has been submitted as an update to Fedora EPEL 10.3. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-3ffce94552
FEDORA-2026-e9bb998784 (libheif-1.23.6-1.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-e9bb998784
FEDORA-EPEL-2026-e3bb3691e1 (libheif-1.23.6-1.el9) has been submitted as an update to Fedora EPEL 9. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-e3bb3691e1
FEDORA-2026-8c900fbe64 has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-8c900fbe64` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-8c900fbe64 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-EPEL-2026-ec3c522676 has been pushed to the Fedora EPEL 10.4 testing repository. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-ec3c522676 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-0ba06812ef has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-0ba06812ef` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-0ba06812ef See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-EPEL-2026-3ffce94552 has been pushed to the Fedora EPEL 10.3 testing repository. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-3ffce94552 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-EPEL-2026-0be17bf6a6 has been pushed to the Fedora EPEL 10.2 testing repository. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-0be17bf6a6 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-EPEL-2026-e3bb3691e1 has been pushed to the Fedora EPEL 9 testing repository. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-e3bb3691e1 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-e9bb998784 has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-e9bb998784` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-e9bb998784 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-42f5a71cb1 (ffmpeg-9.0.2-2.fc46, libheif-1.23.6-3.fc46, and 5 more) has been submitted as an update to Fedora 46. https://bodhi.fedoraproject.org/updates/FEDORA-2026-42f5a71cb1
FEDORA-2026-42f5a71cb1 (ffmpeg-9.0.2-2.fc46, libheif-1.23.6-3.fc46, and 5 more) has been pushed to the Fedora 46 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-EPEL-2026-3ffce94552 (libheif-1.23.6-1.el10_3) has been pushed to the Fedora EPEL 10.3 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-EPEL-2026-ec3c522676 (libheif-1.23.6-1.el10_4) has been pushed to the Fedora EPEL 10.4 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-0ba06812ef (libheif-1.23.6-1.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-e9bb998784 (libheif-1.23.6-1.fc43) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-EPEL-2026-0be17bf6a6 (libheif-1.23.6-1.el10_2) has been pushed to the Fedora EPEL 10.2 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-EPEL-2026-e3bb3691e1 (libheif-1.23.6-1.el9) has been pushed to the Fedora EPEL 9 stable repository. If problem still persists, please make note of it in this bug report.