libheif (Organization): news timeline & CVEs

USN-8846-1: libheif vulnerabilities

Ubuntu USN-8846-1 patches libheif flaws allowing remote denial of service via crafted metadata and HEIF data.

Ubuntu Security Notice USN-8846-1 fixes multiple libheif vulnerabilities discovered by Yuqi Qiu and Xiang Li. CVE-2026-84384 involves incorrect handling of compressed metadata and affects Ubuntu 24.04 LTS and 26.04 LTS; CVE-2026-84446 involves incorrect HEIF sequence data handling and affects Ubuntu 26.04 LTS. A further flaw in image reference handling also enables remote denial of service. All issues could allow a remote attacker to crash applications processing malicious HEIF files.

Ubuntu Security NoticesSep 29, 16:18 UTC · 1d agoAdvisory CVE-2026-84384 CVE-2026-84446

Researchers used Anthropic’s Claude to hack into OpenAI

Researchers used Claude Opus 5 to chain libheif and Discourse flaws, hijacking OpenAI employee ChatGPT and Codex accounts via bug bounty.

A three-person team at startup Hacktron AI chained a libheif memory bug (reached via crafted HEIF/HEIC uploads through Discourse's ImageMagick pipeline, never assigned a CVE) with an account-takeover flaw to access OpenAI employee ChatGPT and Codex accounts, one linked to OpenAI's GitHub organization. OpenAI paid a $6,500 bug bounty and says the issues are resolved; Discourse shipped a fix on July 27 after disclosure. Claude Opus 4.8 failed to produce a working exploit across several sessions, but Opus 5 succeeded within hours of release, underscoring how AI is collapsing the expertise needed to develop exploits.

TechCrunch · SecuritySep 18, 14:00 UTC · 12d agoAI safety & security in the wild1· 1 read

libheif

Timeline2 articles

Related CVEsby mentions

Appears with

USN-8846-1: libheif vulnerabilities

Researchers used Anthropic’s Claude to hack into OpenAI