HEIF Heist: Image Parser Bugs Expose OpenAI, Meta, GitHub to RCE

Hacktron's security team published an investigation codenamed "HEIF Heist," revealing a class of attack paths around HEIF/HEIC/AVIF image parsing: numerous online services process attacker-controlled images through native C/C++ decoders such as libheif and libde265, typically invoked via pipelines like ImageMagick, and exploitation can lead to remote code execution. According to @joshuasaxe, the months-long research by rootxharsh's team demonstrated intrusions into OpenAI, Slack, Meta and other targets. The fix is simple: upgrade the decoders and restrict untrusted image sources.

Confirmed

• The vulnerability spans multiple release families of libheif/libde265, with libde265 versions 1.19–1.23 affected
• Affected services include OpenAI, Slack, Meta, GitHub Enterprise, Rails and Next.js
• Per @cramforce's recap, vulnerabilities disclosed earlier by OpenAI white-hat hacker @S1r1u5 and others reach far beyond one company: any image-processing path accepting attacker-controlled images (e.g., avatar uploads) is at risk; Next.js image optimization depended on libheif, and the Vercel team remediated it and published the process
• Remediation: upgrade libheif and libde265 to the latest versions and disable processing of untrusted HEIF/HEIC/AVIF images
• Security researcher @pbaylies advises any application depending directly or indirectly on libheif or libde265 to check and upgrade immediately

Why it matters

• Image parsing underpins countless web services; an attacker only needs a service to decode one malicious image to gain code execution, making this a low-barrier, wide-impact attack
• As @ccerrato147 notes, the industry invests in product and growth while nobody owns low-level security, so such flaws erupt in neglected dependencies—yet remediation can be done in an afternoon
• @ccerrato147 warns in the closing post: a fragile foundation doesn't care about your valuation—"if you don't look for the holes under your own house, someone else will, and they don't need any permission"

2026-09-18 ~ 2026-09-19 · 8 related posts

Full story(2 episodes)→

• Episode 1: HEIF Heist: Image Parser Bugs Expose OpenAI, Meta, GitHub to RCE(2026-09-18, 8 posts)
• Episode 2: HEIF Heist: AI Finds Uncatalogued Image Parsing Flaws, Earns $100K Bounty(2026-09-25, 2 posts)

• HEIF Heist vulnerability spans multiple libheif/libde265 releases; devs urged to update — pbaylies · 2026-09-18
• [source] HEIF Heist: one C image parser bug chain leads to RCE in OpenAI, Meta, GitHub — ccerrato147 · 2026-09-19
• [source] HEIF Heist author's warning: audit your own foundations before someone else does — ccerrato147 · 2026-09-19
• Image decoding bugs need one afternoon to fix: upgrade libheif, sandbox the pipeline — ccerrato147 · 2026-09-19
• HEIF Heist: one libheif image-parser bug hit OpenAI, Slack, Meta, GitHub Enterprise and more — anshulkundaje · 2026-09-19
• [source] libheif white-hat bug also hit Next.js image optimization; Vercel shares response story — cramforce · 2026-09-19

2 near-duplicate retellings: ccerrato147 · joshua_saxe