Image decoding bugs need one afternoon to fix: upgrade libheif, sandbox the pipeline
ccerrato147 · x · 2026-09-19
Reacting to recurring image-parsing vulnerabilities, the author argues companies keep hiring for product and growth with no one paid to look at the foundations. The fix is not fancy: upgrade libheif and libde265, disable untrusted HEIF and AVIF decoding, and sandbox the image pipeline — an afternoon of work across an entire industry. Otherwise, the group that finds the next bug "will not publish a report."
Related event: HEIF Heist: Image Parser Flaw Exposes OpenAI, Meta, GitHub and More(5 posts)→
More from Infra
- Why Jev-class models could become a near-free judgment primitive running on-device — signulll · 2026-09-19
- Pedro Domingos: Opposing Data Centers Means Keeping Your Country Stupid — pmddomingos · 2026-09-19
- Pedro Domingos: OpenAI and Anthropic's real moat is their massive secured compute — pmddomingos · 2026-09-19
- Fully Local, Private Computer-Use AI Arrives — Runs on a 3060 Ti 12GB — WolframRvnwlf · 2026-09-19
- AWS ships 13 SageMaker inference updates in 2026, cutting cold-start latency up to 65% — AWS ML Blog · 2026-09-19
- Dev Runs World Model LingBot-World 2.0 at 16 FPS on One RTX 5090, 2.5x Faster Than SGLang — Kaarel_Kaarelson · 2026-09-19