HEIF Heist: image parser bugs chained into RCE on OpenAI, Meta, Slack and more
moyix · x · 2026-10-22
Hacktron's 'HEIF Heist' report details a class of remote attack paths against services decoding attacker-controlled HEIF/HEIC/AVIF images. The vulnerable surface sits in native C/C++ decoders (libheif, libde265) typically bundled via ImageMagick, libvips, Sharp, distro packages, or container base images. Crafted .avif/.heic files can fingerprint the remote libheif version, letting attackers fire version-matched n-day or 0-day payloads for memory corruption, data exfiltration, or RCE. Confirmed impacts include dumping OpenAI private repositories, Slack RCE leaking files, RCE in Meta's core product suite via image upload, leaking Redacted users' tokens and AWS credentials, authenticated RCE on Discourse and GitHub Enterprise (CVE-2026-19118), and unauthenticated RCE in Next.js via AVIF optimization. The research grew out of the team's security testing of frontier AI labs.
More from Safety
- Banks brace for AI worst-case scenarios as rapid AI progress becomes a security nightmare — kimmonismus · 2026-10-22
- Your unpublished ideas in chatbots could leak—experts on how to reduce the risk — _akpiper · 2026-10-22
- AI cyber offense vs defense is just the same old arms race, says security pro — ziv_ravid · 2026-10-22
- Open models will be the central pillar of AI cyber defense, argues security thread on PHP bugs — ziv_ravid · 2026-10-22
- Axios scoop: US banks detect unauthorized AI agents inside customer accounts — daniel_mac8 · 2026-10-22
- Reddit user asks when labs will open biotech-grade AI capabilities to consumers — Auriga33 · 2026-10-22