Four libheif Defects You Can Catch Before Decoding

Sun, 20 Sep 2026 00:00:00 +0200

Hacktron’s HEIF Heist research turned libheif into the most interesting image-parsing target of the year. Their team, led by Harsh Jaiswal with Mohan SRK, Rahul Maini and Sudhanshu Rajbhar, chained decoder bugs into remote code execution against OpenAI, Slack, Meta, GitHub Enterprise, Discourse and Next.js, all through ordinary image uploads and image optimization endpoints.

The OpenAI chain reads like a tour of how deep an image decoder sits in a modern stack: a HEIC file uploaded to community.openai.com, converted by ImageMagick, parsed by libheif 1.19.7, heap overflow, remote code execution, administrative access to the forum, then an SSO flaw that gave them an OpenAI employee account with Codex access to GitHub and, through it, the internal monorepo. OpenAI paid $6,500. The libheif bug they used carried no CVE at the time, because upstream had fixed it quietly.

AVIF on Matt Suiche

Four libheif Defects You Can Catch Before Decoding