Skip to content
NewA calmer, faster ZeroHour
StoryResearchhigh

HEIF Heist

3 sources · 3 articlesFirst reported Updated ()9 · 1 read
Merged summary · from the lead articleSummaries by Vani AI

Hacktron's HEIF Heist research reveals RCE and heap-leak vulnerabilities in libheif/libde265 HEIF/AVIF decoders, affecting Meta, OpenAI, GitHub Enterprise, Discourse, and Next.js.

Hacktron researchers describe 'HEIF Heist,' a class of attack paths against services decoding attacker-controlled HEIF, HEIC, or AVIF images via native C/C++ parsers libheif and libde265. Demonstrated impacts include RCE in Meta's product suite via image upload, authenticated RCE on Discourse and GitHub Enterprise (CVE-2026-19118), unauthenticated RCE in Next.js via AVIF optimization, a Slack RCE used to dump OpenAI private repositories, and heap disclosure of user tokens and AWS access tokens. Exploitation requires fingerprinting the remote libheif version and tailoring payload images; AI assistance reportedly cut exploit development to 1-3 days. Mitigations include upgrading to libheif v1.23.2 or later, patching libde265, and disabling or sandboxing untrusted HEIF/AVIF decoding.

Key facts
  • Native C/C++ decoders libheif and libde265 enable framework-agnostic RCE and heap disclosure across versions 1.19.x-1.23.x
  • Impacts include OpenAI repository dumps via Slack, Meta product suite RCE, unauthenticated Next.js RCE via AVIF
  • Exploitation requires version fingerprinting and tailored payloads; AI assistance cut exploit development to 1-3 days
  • Fix by upgrading to libheif v1.23.2+, updating libde265, and disabling or sandboxing untrusted HEIF/AVIF decoding
  • Attack surface enters production indirectly via ImageMagick, libvips, Sharp, distro packages, and container base images
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
CVEs
CVE-2026-19118CVE-2026-32882
Vendors
MetaOpenAIGitHubDiscourseVercelSlackImageMagickNext.jsAnthropicAmazon Web ServicesMalwarebytesBugcrowd
Products
libheiflibde265GitHub EnterpriseNext.jsImageMagickGitHub Enterprise ServerSlackDiscourseChatGPTCodexGPT-5.6 SolClaude Opus 5
Victims
OpenAISlackMetaGitHubDiscourseShopify
Organizations
HacktronOpenAIMetaDiscourseAnthropicBugcrowdDebianShopifyMicrosoft
AI models
GPT-5.6 SolClaudeClaude Opus 5Claude Opus 4.8Opus 4.8Opus 5

Coverage

oldest first · one row per article · UTC
  1. · Sep 18, 2026 The Register · SecurityFirst report

    Researchers used Claude to hack OpenAI employees' ChatGPT accounts

    Researchers chained a libheif heap overflow with an SSO misconfiguration to take over OpenAI employee ChatGPT accounts, earning a $6,500 bounty.

  2. · Sep 18, 2026 CyberScoop

    Researchers use AI to find widespread software decoder flaw

    Hacktron researchers, aided by Claude and GPT-5.6 Sol, disclosed HEIF Heist, memory-corruption flaws in libheif/libde265 enabling RCE against major platforms.

  3. · Sep 18, 2026 The Decoder

    Security researchers used Anthropic's Claude to hack OpenAI's internal systems in under 72 hours

    Hacktron researchers used Claude Opus 5 to exploit libheif and an SSO flaw, taking over OpenAI employee ChatGPT and Codex accounts within 72 hours.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-19118
Race Condition RCE in GitHub Enterprise Server
7.7<1%
CVE-2026-32882
libheif is a HEIF and AVIF file format decoder and encoder
7.1<1%