HEIF Heist Image Parser Flaws Tied to RCE

Hacktron's HEIF Heist links libheif and libde265 flaws to image-upload RCE affecting Slack, Meta, GitHub, Discourse, and OpenAI.

Hacktron's HEIF Heist research describes memory-unsafe HEIF and AVIF parsing in libheif and libde265, reached through ImageMagick, libvips, and Sharp, that can lead to heap disclosure and remote code execution from crafted image uploads. The reports cite affected paths in Slack, Meta products, Discourse, Next.js, and GitHub Enterprise Server, including authenticated RCE tracked as CVE-2026-19118. In July 2026, researchers chained a libheif heap-buffer overflow in Discourse with an OpenAI SSO flaw and received a $6,500 bounty; one source says OpenAI patched within 14 hours. Sources disagree on what that chain exposed: employee ChatGPT accounts in one account, an employee's Codex account and an internal GitHub repository in another, and internal repositories more generally in a third. They also disagree on the AI used, naming Claude Opus 5, Anthropic's Claude, or unnamed agentic workflows that cut exploit development to one to three days. No active malware campaigns were identified, and suggested mitigations include patching the libraries, restricting formats in ImageMagick policy, and sandboxing conversion.

• Hacktron's HEIF Heist research describes memory-unsafe libheif and libde265 parsers for HEIC, HEIF, and AVIF, reached via ImageMagick, libvips, and Sharp.
• Reported effects include heap disclosure and remote code execution from crafted image uploads, with paths cited in Slack, Meta products, Discourse, Next.js, and GitHub Enterprise Server.
• CVE-2026-19118 is described as authenticated remote code execution in GitHub Enterprise Server.
• In July 2026, a libheif heap-buffer overflow in Discourse was chained with an OpenAI SSO flaw; OpenAI paid a $6,500 bounty and, per one report, patched within 14 hours.
• Sources disagree on the OpenAI outcome: employee ChatGPT accounts versus an employee's Codex account and an internal GitHub repository, with a third report citing internal repositories more generally.
• Sources also disagree on AI assistance, naming Claude Opus 5, Anthropic's Claude, or unspecified agentic workflows that shortened development to one to three days.
• One report said no active malware campaigns had been identified.
• Cited mitigations are patching libheif and libde265, restricting formats in ImageMagick policy, and sandboxing conversion.