HEIF Heist: image parser bugs could dump OpenAI repos and RCE Meta's suite
Miles_Brundage · x · 2026-10-28
Former OpenAI policy lead Miles Brundage notes that beyond the OpenAI monorepo leak, attackers had (potential) access to far more — citing Hacktron's HEIF Heist research.
HEIF Heist is a class of remote attack paths targeting services that decode attacker-controlled HEIF/HEIC/AVIF images via native C/C++ parsers like libheif and libde265, typically bundled indirectly through ImageMagick, libvips, Sharp, distro packages, or container base images. Crafted .avif/.heic uploads can fingerprint the remote libheif version, then trigger memory corruption, data exposure, or RCE.
Reported impacts include:
- Dump of OpenAI private repositories
- RCE on Slack enabling file leaks
- RCE across Meta's core product suite via image upload
- Leaking arbitrary Redacted user tokens and AWS access tokens
- Authenticated RCE on Discourse and GitHub Enterprise (CVE-2026-19118); unauthenticated RCE in Next.js via AVIF optimization
The research grew out of Hacktron's security work on frontier labs, after finding a libheif RCE in Discourse.
More from Safety
- eMudhra intermediate CA key compromise flagged P1 by Mozilla amid private comms — kingslyj · 2026-10-28
- Security researchers weigh whether AI-driven economic disruption will fuel global cybercrime — joshua_saxe · 2026-10-28
- CoDA enforces security policies inside diffusion LLM decoding, 0% injection success — nandofioretto · 2026-10-28
- AI policy researcher Janet Egan joins IFP as director of emerging tech — RishiBommasani · 2026-10-28
- AI cyber-wreckage noise far outstrips actual damage so far, argues new analysis — timigod · 2026-10-28
- OpenAI to co-host webinar on php2shell disclosure and AI-driven vulnerability discovery — gdb · 2026-10-28