HEIF Heist
Hacktron's HEIF Heist research reveals RCE and heap-leak vulnerabilities in libheif/libde265 HEIF/AVIF decoders, affecting Meta, OpenAI, GitHub Enterprise, Discourse, and Next.js.
Hacktron researchers describe 'HEIF Heist,' a class of attack paths against services decoding attacker-controlled HEIF, HEIC, or AVIF images via native C/C++ parsers libheif and libde265. Demonstrated impacts include RCE in Meta's product suite via image upload, authenticated RCE on Discourse and GitHub Enterprise (CVE-2026-19118), unauthenticated RCE in Next.js via AVIF optimization, a Slack RCE used to dump OpenAI private repositories, and heap disclosure of user tokens and AWS access tokens. Exploitation requires fingerprinting the remote libheif version and tailoring payload images; AI assistance reportedly cut exploit development to 1-3 days. Mitigations include upgrading to libheif v1.23.2 or later, patching libde265, and disabling or sandboxing untrusted HEIF/AVIF decoding.
- Native C/C++ decoders libheif and libde265 enable framework-agnostic RCE and heap disclosure across versions 1.19.x-1.23.x
- Impacts include OpenAI repository dumps via Slack, Meta product suite RCE, unauthenticated Next.js RCE via AVIF
- Exploitation requires version fingerprinting and tailored payloads; AI assistance cut exploit development to 1-3 days
- Fix by upgrading to libheif v1.23.2+, updating libde265, and disabling or sandboxing untrusted HEIF/AVIF decoding
- Attack surface enters production indirectly via ImageMagick, libvips, Sharp, distro packages, and container base images
Vulnerabilities mentionedAll →
- CVE-2026-191187.7<1%Race Condition RCE in GitHub Enterprise Serverpublished · github enterprise server
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-19118 | Race Condition RCE in GitHub Enterprise Server CVE-2026-19118 is a time-of-check time-of-use (TOCTOU) race condition (CWE-367) in GitHub Enterprise Server that can lead to remote code execution. An attacker needs an authenticated account with write access to a repository and must time concurrent upload requests precisely to win the race window. If triggered successfully, the attacker gains remote code execution on the GHES appliance, taking control of the self-hosted instance and the code repositories it hosts. All versions of GitHub Enterprise Server prior to 3.22 are affected, and fixes are available in the 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5 maintenance releases. There is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.5% probability of exploitation within 30 days, so no exploitation is currently known. |
Full article715 words · extracted from heif-heist.com · click to collapse
What is HEIF Heist?
A bug that could have allowed us to
HEIF Heist is Hacktron's name for a class of remote attack paths targeting services that decode attacker-controlled HEIF, HEIC, or AVIF images. By exploiting underlying native libraries, these vulnerabilities allow an attacker to bypass application-level defenses and trigger memory corruption, data exposure, or remote code execution (RCE).
The vulnerable attack surface lives below the application layer inside native C/C++ decoders such as libheif and libde265. These parsers typically enter production environments indirectly bundled via higher-level wrappers like ImageMagick, libvips, or Sharp, standard distro packages, and prebuilt container base images.
By probing upload endpoints with crafted .avif or .heic files, an attacker can fingerprint the remote libheif version family in use. Once identified, they can fire an exact version-matched n-day or 0-day payload to trigger memory corruption, data exfiltration, or remote code execution.
Research origin
HEIF Heist began as part of the Hacktron research team's broader security research into frontier labs. After discovering and reporting a libheif RCE in Discourse, we asked a larger question: how many other applications depend on the same image-processing stack?
Past vulnerabilities such as ImageTragick, ForcedEntry, and the libwebp flaw have demonstrated the reach of an image processor or parser vulnerability. An image parser might generate an operating-system thumbnail or process a web upload, giving it an enormous blast radius.
That initial finding grew into a multi-month investigation tracing libheif across communication platforms, cloud services, enterprise products, and popular web frameworks.
FAQ
Why is it called HEIF Heist?
Even when Remote Code Execution (RCE) isn't immediately achievable, the attack primitives may still allow arbitrary heap disclosure, letting an attacker “heist” in-memory data such as other users' data and environment variables.
What makes it unique?
The vulnerability sits inside native C/C++ parsers (libheif / libde265), making it completely language and framework-agnostic. Any backend processing untrusted user image uploads is potentially exposed to these parsers.
What versions are affected, and how do I fix it?
HEIF Heist is not tied to a single version. It targets an entire ecosystem of vulnerabilities across multiple release families (e.g. 1.19.x, 1.20.x, 1.22.x, 1.23.x). Any deployment lacking the latest upstream security patches is potentially vulnerable.
- Update upstream. Upgrading to
libheifv1.23.2 or later and the latestlibde265, via your distribution's security channel or a direct source build, is recommended to patch known 0-day and n-day vectors. - Defense in depth. Given the complexity of the ISO base media file format and the pace of decoder updates, future memory-safety flaws are likely. Production architectures should disable untrusted HEIF/AVIF decoding where it is not needed, or isolate image-processing pipelines inside hardened, ephemeral sandboxes.
Separately, if you self-host Discourse or Next.js, ensure you are on the latest release and follow their security advisories.
Is it easy to exploit?
These are not out-of-the-box exploits. Exploitation requires fingerprinting the target version and tailoring the payload image(s). Some of our RCE attempts landed only after thousands of image uploads. That said, an AI agentic approach with a frontier model like GPT-5.6 Sol cut exploit development time down to roughly 1 to 3 days from initial probe to remote RCE. A motivated attacker can convert a vulnerable upload endpoint into RCE or an info leak.
Who found it?
Led by Harsh Jaiswal, alongside Mohan SRK, Rahul Maini, and Sudhanshu Rajbhar from the Hacktron research team, assisted by Hacktron Harness, GPT-5.6 Sol, and Opus 5.
Work with the team behind this research.
Hacktron brings together top CTF researchers, experienced red teamers, and offensive security researchers. We use AI to accelerate security research, finding and eliminating vulnerabilities in widely trusted software before malicious actors do. We're continuing our research across frontier labs and other internet-critical systems. If you're responsible for securing one of them, we'd like to work with you.