libheif white-hat bug also hit Next.js image optimization; Vercel shares response story
cramforce · x · 2026-09-19
The OpenAI white-hat libheif vulnerability wasn't isolated: any image-processing path accepting attacker-controlled images (e.g. avatar uploads) was exposed, including Next.js image optimization. Vercel collaborated with @HacktronAI to reproduce the bug, responsibly disclose it, and map the dependency chain. Notably, users on Vercel's platform were protected via sandboxing of image-handling code. The post is a full incident-response writeup, including tracking down "the literal guy in Nebraska" as xkcd predicted.
Related event: HEIF Heist: Image Parser Bugs Expose OpenAI, Meta, GitHub to RCE(8 posts)→
More from coding & agent
- The decade of agents: simulate real customers to test your agent before launch — EXM7777 · 2026-11-11
- FluentCRM MCP Server lets you manage marketing automation from Cursor or Claude — modelcontextprotocol · 2026-11-11
- Databricks' revised Genie agent tells CEO Ali Ghodsi the unvarnished truth — TechCrunch AI · 2026-11-11
- Elvis Saravia: agents will subsume traditional software — and can even cut code bloat — omarsar0 · 2026-11-11
- Every launches Everycut, an agent-native Mac video editor where every control is an agent tool — every · 2026-11-11
- Anthropic's Fable 5.2 built a professional video editor overnight, unsupervised — every · 2026-11-11