Image decoding bugs need one afternoon to fix: upgrade libheif, sandbox the pipeline

ccerrato147 · x · 2026-09-19

Reacting to recurring image-parsing vulnerabilities, the author argues companies keep hiring for product and growth with no one paid to look at the foundations. The fix is not fancy: upgrade libheif and libde265, disable untrusted HEIF and AVIF decoding, and sandbox the image pipeline — an afternoon of work across an entire industry. Otherwise, the group that finds the next bug "will not publish a report."

Related event: HEIF Heist: Image Parser Flaw Exposes OpenAI, Meta, GitHub and More(5 posts)→

Original post →

More from Infra

Infra channel →