Ubuntu alert USN-8526-2 (libheif)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8526-2] libheif vulnerabilities
Date:
             
 
Tue, 14 Jul 2026 19:17:12 +0000
Message-ID:
             
 
<E1wjicy-0005C6-Vi@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8526-2
July 14, 2026

libheif vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS

Summary:

Several security issues were fixed in libheif.

Software Description:
- libheif: An ISO/IEC 23008-12:2017 HEIF and AVIF file format decoder and encoder

Details:

USN-8526-1 fixed vulnerabilities in libheif. This update provides the
corresponding updates for CVE-2026-47709 and CVE-2026-47714 in
Ubuntu 24.04 LTS.

Original advisory details:

 Junyi Liu discovered that libheif had a null pointer dereference in its
 image tiling interface. An attacker could possibly use this issue to
 cause a denial of service. (CVE-2026-47709)

 Calvin Young and Enoch Chow discovered that libheif had an integer
 overflow in its inline mask size calculation. An attacker could
 possibly use this issue to cause a denial of service or obtain sensitive
 information. (CVE-2026-47714)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
  heif-gdk-pixbuf                 1.17.6-1ubuntu4.6
  heif-thumbnailer                1.17.6-1ubuntu4.6
  libheif-dev                     1.17.6-1ubuntu4.6
  libheif-plugin-aomdec           1.17.6-1ubuntu4.6
  libheif-plugin-aomenc           1.17.6-1ubuntu4.6
  libheif-plugin-dav1d            1.17.6-1ubuntu4.6
  libheif-plugin-ffmpegdec        1.17.6-1ubuntu4.6
  libheif-plugin-j2kdec           1.17.6-1ubuntu4.6
  libheif-plugin-j2kenc           1.17.6-1ubuntu4.6
  libheif-plugin-jpegdec          1.17.6-1ubuntu4.6
  libheif-plugin-jpegenc          1.17.6-1ubuntu4.6
  libheif-plugin-libde265         1.17.6-1ubuntu4.6
  libheif-plugin-rav1e            1.17.6-1ubuntu4.6
  libheif-plugin-svtenc           1.17.6-1ubuntu4.6
  libheif-plugin-x265             1.17.6-1ubuntu4.6
  libheif1                        1.17.6-1ubuntu4.6

In general, a standard system update will make all the necessary
changes.

References:
  https://ubuntu.com/security/notices/USN-8526-2
  https://ubuntu.com/security/notices/USN-8526-1
  CVE-2026-47709, CVE-2026-47714

Package Information:
  https://launchpad.net/ubuntu/+source/libheif/1.17.6-1ubun...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmpWhPoACgkQcpJm3tlz
hgGToRAAueXrovyTW2Arp2A/V1zbP0J4yN6CMg8YGaOj7od4NmdE6D5Dy8OwvJYy
mpWE7Tfw/K17tP/0jMDUMyCrjHYSz+0tZUJLUw8GKUxTbVD2qMdKhTDm6FJn0fVC
MKZ+TLflO2KY588XBvLPv0Gir9wBbW5W57DTz9U9aXmerBUo1cMhxVQGZwU+izmG
hyEaJqIQBFsdJpnZMDjt+6D5YyIg7PERKCPmqwRCLPI1DN+MNO9aLkHbMTcHGqO0
4/dzJQI+vyYkxWM+unziIFo8Mx9HDV3SV1lkWOEK5d9ZzA47zwsV4mgSpEBKdXDg
JrAiGQm/9z9XXutsZ2iO9CwhtP7DSuuwz+9ANcvRjv/+2HREeo2Zo4fXOzDoufTh
2ti/QJuD3nv106C0Z46ovI8f6AStUppAYWcGrG+gBa8e2V9ZJLfyVD0HRhK+WoWW
pmyObrDTJhfDtzS6JCb1MmeNP0rlL9FS9ABNPm+0VJp5cAQcwji/qj378CyXJg9C
3PIc/j/KRXUMd4hMoncChcpSahf9OlfMjWWE6Gtz5LsVnIZA/yKih3Wd2A24IP7J
EGbwCwL1qT5SGLPrZ5ItBUaM72GUr7d8pw6UP7DY6E57jsBYKF36pU6NvBhU25JG
S1PrDPuFi6Y7wkvUuElLRqPDCBDfarw6gdmpx/32Lx/Mp6xqj5A=
=GPpk
-----END PGP SIGNATURE-----