Amazon Linux 2023 : heif-pixbuf-loader, libheif, libheif-devel (ALAS2023-2026-3314)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3314 advisory. libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompressbrotli and doinflate to grow...

DEBIAN-CVE-2026-84384

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompressbrotli and doinflate to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no outpu...

CVE-2026-84384

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompressbrotli and doinflate to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no outpu...

UBUNTU-CVE-2026-84384

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompressbrotli and doinflate to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no outpu...

CVE-2026-84384

libheif (a HEIF and AVIF file format decoder/encoder) is affected by a decompression-bomb OOM/DoS vulnerability in versions 1.19.0 through 1.23.1 . Crafted HEIF or AVIF files with malicious mime metadata and unci image data cause decompress_brotli() and do_inflate() to grow accumulated output wit...

CVE-2026-84384 libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompressbrotli and doinflate to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no outpu...

EUVD-2026-83022

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompressbrotli and doinflate to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no outpu...

CVE-2026-84384: Improper Handling of Highly Compressed Data (Data Amplification)

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompressbrotli and doinflate to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no outpu...