HEIF Heist: Inside the Image-Parsing Vulnerability Chain

Episode 1 · HEIF Heist: Image Parser Bugs Expose OpenAI, Meta, GitHub to RCE (2026-09-18, 8 posts)

Hacktron's security team published an investigation codenamed "HEIF Heist," revealing a class of attack paths around HEIF/HEIC/AVIF image parsing: numerous online services process attacker-controlled images through native C/C++ decoders such as libheif and libde265, typically invoked via pipelines like ImageMagick, and exploitation can lead to remote code execution. According to @joshuasaxe, the months-long research by rootxharsh's team demonstrated intrusions into OpenAI, Slack, Meta and other targets. The fix is simple: upgrade the decoders and restrict untrusted image sources.

Confirmed

• The vulnerability spans multiple release families of libheif/libde265, with libde265 versions 1.19–1.23 affected
• Affected services include OpenAI, Slack, Meta, GitHub Enterprise, Rails and Next.js
• Per @cramforce's recap, vulnerabilities disclosed earlier by OpenAI white-hat hacker @S1r1u5 and others reach far beyond one company: any image-processing path accepting attacker-controlled images (e.g., avatar uploads) is at risk; Next.js image optimization depended on libheif, and the Vercel team remediated it and published the process
• Remediation: upgrade libheif and libde265 to the latest versions and disable processing of untrusted HEIF/HEIC/AVIF images
• Security researcher @pbaylies advises any application depending directly or indirectly on libheif or libde265 to check and upgrade immediately

Why it matters

• Image parsing underpins countless web services; an attacker only needs a service to decode one malicious image to gain code execution, making this a low-barrier, wide-impact attack
• As @ccerrato147 notes, the industry invests in product and growth while nobody owns low-level security, so such flaws erupt in neglected dependencies—yet remediation can be done in an afternoon
• @ccerrato147 warns in the closing post: a fragile foundation doesn't care about your valuation—"if you don't look for the holes under your own house, someone else will, and they don't need any permission"

• HEIF Heist vulnerability spans multiple libheif/libde265 releases; devs urged to update — pbaylies · 2026-09-18
• HEIF Heist: one C image parser bug chain leads to RCE in OpenAI, Meta, GitHub — ccerrato147 · 2026-09-19
• HEIF Heist author's warning: audit your own foundations before someone else does — ccerrato147 · 2026-09-19
• HEIF Heist: one C image parser bug chain hits OpenAI, Slack, Meta and GitHub Enterprise — ccerrato147 · 2026-09-19
• Image decoding bugs need one afternoon to fix: upgrade libheif, sandbox the pipeline — ccerrato147 · 2026-09-19
• HEIF Heist: one libheif image-parser bug hit OpenAI, Slack, Meta, GitHub Enterprise and more — anshulkundaje · 2026-09-19
• HEIF Heist: one libheif flaw let researchers hack OpenAI, Slack, Meta and more — joshua_saxe · 2026-09-19
• libheif white-hat bug also hit Next.js image optimization; Vercel shares response story — cramforce · 2026-09-19

Episode 2 · HEIF Heist: AI Finds Uncatalogued Image Parsing Flaws, Earns $100K Bounty (2026-09-25, 2 posts)

Hacktron's 'HEIF Heist' research used AI to uncover silently patched, CVE-less flaws in image parsing libraries like libheif, earning a $100K bounty from Meta for an FB/Instagram RCE chain, an achievement security researchers say redefines the attacker profile.

• HEIF Heist: image parser RCE chain nets $100k Meta bounty, hits OpenAI repos and more — evilsocket · 2026-09-25
• HEIF Heist shows AI attackers doing what no bug bounty researcher ever has — moyix · 2026-09-26