HEIF Heist
Hacktron's HEIF Heist research reveals RCE and heap-leak vulnerabilities in libheif/libde265 HEIF/AVIF decoders, affecting Meta, OpenAI, GitHub Enterprise, Discourse, and Next.js.
Hacktron researchers describe 'HEIF Heist,' a class of attack paths against services decoding attacker-controlled HEIF, HEIC, or AVIF images via native C/C++ parsers libheif and libde265. Demonstrated impacts include RCE in Meta's product suite via image upload, authenticated RCE on Discourse and GitHub Enterprise (CVE-2026-19118), unauthenticated RCE in Next.js via AVIF optimization, a Slack RCE used to dump OpenAI private repositories, and heap disclosure of user tokens and AWS access tokens. Exploitation requires fingerprinting the remote libheif version and tailoring payload images; AI assistance reportedly cut exploit development to 1-3 days. Mitigations include upgrading to libheif v1.23.2 or later, patching libde265, and disabling or sandboxing untrusted HEIF/AVIF decoding.
- Native C/C++ decoders libheif and libde265 enable framework-agnostic RCE and heap disclosure across versions 1.19.x-1.23.x
- Impacts include OpenAI repository dumps via Slack, Meta product suite RCE, unauthenticated Next.js RCE via AVIF
- Exploitation requires version fingerprinting and tailored payloads; AI assistance cut exploit development to 1-3 days
- Fix by upgrading to libheif v1.23.2+, updating libde265, and disabling or sandboxing untrusted HEIF/AVIF decoding
- Attack surface enters production indirectly via ImageMagick, libvips, Sharp, distro packages, and container base images
- CVEs
- CVE-2026-19118
- Organizations
- Hacktron
- AI models
- GPT-5.6 Sol
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19118 | Race Condition RCE in GitHub Enterprise Server | 7.7 | <1% |
From the original article
3 min read at heif-heist.com
Leak arbitrary Redacted users' tokens, and AWS access tokens Leak user's files, and sensitive info from multiple applications. HEIF Heist is Hacktron's name for a class of remote attack paths targeting services that decode attacker-controlled HEIF, HEIC, or AVIF images.
By heif-heist.com via atmosx · heif-heist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.