HEIF Heist Image Flaws Let Attackers Gain RCE Across Meta, Slack and GitHub Enterprise
Hacktron's "HEIF Heist" research shows memory-unsafe HEIF/AVIF parsers enable RCE and data leaks in Slack, Meta, GitHub Enterprise, and OpenAI.
Hacktron disclosed a class of attack paths in the HEIF/AVIF decoding ecosystem, chiefly memory-unsafe libheif and libde265 parsers reached via ImageMagick, libvips, and Sharp, enabling heap disclosure and remote code execution. The team demonstrated RCE paths in Slack, Meta's product suite, GitHub Enterprise Server (CVE-2026-19118, authenticated RCE), Discourse, and Next.js. They chained a libheif heap buffer overflow with an OpenAI SSO flaw to compromise employee ChatGPT accounts in July 2026, earning a $6,500 bounty; OpenAI patched within 14 hours. AI-assisted agentic workflows reportedly cut exploit development to one to three days.
- Multiple bugs in libheif/libde265 enable heap disclosure and RCE via image uploads.
- CVE-2026-19118: authenticated RCE in GitHub Enterprise Server.
- Researchers compromised OpenAI employee ChatGPT accounts via a Discourse upload chain.
- AI models helped develop exploit primitives, reducing attack development to days.
- Mitigations: patch libheif/libde265, restrict formats via ImageMagick policy, sandbox conversion.
- CVEs
- CVE-2026-19118
- Victims
- OpenAI
- Organizations
- Hacktron
- AI models
- GPT-5.6 SolClaude
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19118 | Race Condition RCE in GitHub Enterprise Server | 7.7 | <1% |
From the original article
4 min read at gbhackers.com
“HEIF Heist,” a broad class of image-processing attack paths that could allow threat actors to turn malicious HEIF, HEIC, and AVIF uploads into remote code execution, sensitive-data exposure, and account compromise across major technology and enterprise platforms.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.