HEIF Heist

Hacktron's HEIF Heist research reveals RCE and heap-leak vulnerabilities in libheif/libde265 HEIF/AVIF decoders, affecting Meta, OpenAI, GitHub Enterprise, Discourse, and Next.js.

Hacktron researchers describe 'HEIF Heist,' a class of attack paths against services decoding attacker-controlled HEIF, HEIC, or AVIF images via native C/C++ parsers libheif and libde265. Demonstrated impacts include RCE in Meta's product suite via image upload, authenticated RCE on Discourse and GitHub Enterprise (CVE-2026-19118), unauthenticated RCE in Next.js via AVIF optimization, a Slack RCE used to dump OpenAI private repositories, and heap disclosure of user tokens and AWS access tokens. Exploitation requires fingerprinting the remote libheif version and tailoring payload images; AI assistance reportedly cut exploit development to 1-3 days. Mitigations include upgrading to libheif v1.23.2 or later, patching libde265, and disabling or sandboxing untrusted HEIF/AVIF decoding.

• Native C/C++ decoders libheif and libde265 enable framework-agnostic RCE and heap disclosure across versions 1.19.x-1.23.x
• Impacts include OpenAI repository dumps via Slack, Meta product suite RCE, unauthenticated Next.js RCE via AVIF
• Exploitation requires version fingerprinting and tailored payloads; AI assistance cut exploit development to 1-3 days
• Fix by upgrading to libheif v1.23.2+, updating libde265, and disabling or sandboxing untrusted HEIF/AVIF decoding
• Attack surface enters production indirectly via ImageMagick, libvips, Sharp, distro packages, and container base images