Image decoding bugs need one afternoon to fix: upgrade libheif, sandbox the pipeline
ccerrato147 · x · 2026-09-19
Reacting to recurring image-parsing vulnerabilities, the author argues companies keep hiring for product and growth with no one paid to look at the foundations. The fix is not fancy: upgrade libheif and libde265, disable untrusted HEIF and AVIF decoding, and sandbox the image pipeline — an afternoon of work across an entire industry. Otherwise, the group that finds the next bug "will not publish a report."
Related event: HEIF Heist: Image Parser Bugs Expose OpenAI, Meta, GitHub to RCE(8 posts)→
More from Infra
- Nvidia struggles to hire RL talent from Anthropic, highlighting chipmakers' reinforcement learning gap — teortaxesTex · 2026-11-04
- Sam Altman? No—Bezos Calls for Nuclear-Powered Offshore Data Center Platforms — beffjezos · 2026-11-04
- SpecPilot agent boosts speculative decoding from 4.46× to 10.87×, no retraining — pmttyji · 2026-11-04
- NEURA launches Neuron AI, but Europe's Physical AI test is whether the stack matures together — ingliguori · 2026-11-04
- S3-based databases cache in memory and NVMe, making disk vs S3 latency gap smaller than expected — mgill25 · 2026-11-04
- gpu-unlock project claims up to 2x FP16 tensor throughput for RTX 20/30/40 cards — paranoidray · 2026-11-04