QSN-8846-1: libheif vulnerabilities
2026-09-29

Summary:
Several security issues were fixed in libheif.

Details:
Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain
compressed metadata. A remote attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 24.04 LTS and
Ubuntu 26.04 LTS. (CVE-2026-84384)

Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain
HEIF sequence data. A remote attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-84446)

Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain
image references. A remote attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-84447)

It was discovered that libheif incorrectly handled certain region masks.
A local attacker could possibly use this issue to obtain sensitive
information or cause a denial of service. This issue only affected Ubuntu
24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-84448)

It was discovered that libheif incorrectly handled certain images. A
remote attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-84449)

Affected QuantaStor releases:
  6.9.1.001 jammy: libheif1 1.12.0-2ubuntu0.1~esm1 (fixed in 1.12.0-2ubuntu0.1~esm5)
  6.9.0.464 jammy: libheif1 1.12.0-2ubuntu0.1~esm1 (fixed in 1.12.0-2ubuntu0.1~esm5)
  6.8.6.015 jammy: libheif1 1.12.0-2ubuntu0.1~esm1 (fixed in 1.12.0-2ubuntu0.1~esm5)
  6.8.5.018 jammy: libheif1 1.12.0-2ubuntu0.1~esm1 (fixed in 1.12.0-2ubuntu0.1~esm5)
  6.8.4.038 jammy: libheif1 1.12.0-2ubuntu0.1~esm1 (fixed in 1.12.0-2ubuntu0.1~esm5)
  6.8.3.018 jammy: libheif1 1.12.0-2ubuntu0.1~esm1 (fixed in 1.12.0-2ubuntu0.1~esm5)
  6.8.2.002 jammy: libheif1 1.12.0-2ubuntu0.1~esm1 (fixed in 1.12.0-2ubuntu0.1~esm5)
  6.8.1.007 jammy: libheif1 1.12.0-2ubuntu0.1~esm1 (fixed in 1.12.0-2ubuntu0.1~esm5)
  6.8.0.205 jammy: libheif1 1.12.0-2ubuntu0.1~esm1 (fixed in 1.12.0-2ubuntu0.1~esm5)

CVEs: CVE-2026-84384, CVE-2026-84449, CVE-2026-84448, CVE-2026-84446, CVE-2026-84447

References:
  https://ubuntu.com/security/notices/USN-8846-1