BlackTreeLifecycle intelligence
Evidence-linked product lifecycle intelligenceSUPPORT · SECURITY · RETIREMENT
← Lifecycle catalogue
UBUNTU SECURITY NOTICECANONICALVERIFIED

PUBLISHER UPDATE · USN-8846-1

USN-8846-1 release notes and known issues

USN-8846-1: libheif vulnerabilities

Scope: Ubuntu. This update record adds version, fix and known-issue context. Its publication date is not a lifecycle boundary.

Summary

Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain compressed metadata. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-84384) Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain HEIF sequence data. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-84446) Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain image references. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-84447) It was discovered that libheif incorrectly handled certain region masks. A local attacker could possibly use this issue to obtain sensitive information or cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-84448) It was discovered that libheif incorrectly handled certain images. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-84449)

Improvements and security content

  • Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain compressed metadata. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-84384) Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain HEIF sequence data. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-84446) Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain image references. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-84447) It was discovered that libheif incorrectly handled certain region masks. A local attacker could possibly use this issue to obtain sensitive information or cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-84448) It was discovered that libheif incorrectly handled certain images. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-84449)

Known issues

Publisher statement

Not stated. The verified publisher record does not contain a known-issues statement.

Affected products and versions

Products

  • Ubuntu

Affected versions

  • 24.04
  • 26.04
  • 18.04
  • 20.04
  • 22.04

Fixed versions or updates

  • No fixed version is stated in this record.

Recommended action

Review the official publisher document before deployment.

Related vulnerabilities

BlackTree CVE Intelligence
CVE-2026-84384Open CVE report →CVE-2026-84446Open CVE report →CVE-2026-84447Open CVE report →CVE-2026-84448Open CVE report →CVE-2026-84449Open CVE report →

These links connect the publisher update to related Lifecycle records without treating the update publication date as an end-of-support date.

Ubuntu 24.04 LTSOpen lifecycle record →

Official publisher evidence

CANONICALVERIFIED

USN-8846-1: libheif vulnerabilities

Checked 30 Sep 2026. BlackTree preserves the last verified facts if a later source check is temporarily unavailable.

Open the official publisher source