HEIF Heist – One image parser to pwn them all

Hacktron disclosed a class of remote attack paths it calls HEIF Heist, targeting services that decode attacker-controlled HEIF, HEIC, or AVIF images through native C/C++ parsers such as libheif and libde265. The research, which began with a libheif RCE reported in Discourse, produced RCE or data-exposure findings against OpenAI private repositories, Slack, Meta's core product suite, Redacted, Next.js AVIF image optimization, GitHub Enterprise (CVE-2026-19118), and multiple web frameworks and CMSes. Hacktron said the flaws span multiple libheif release families including 1.19.x, 1.20.x, 1.22.x, and 1.23.x, and that upgrading to libheif v1.23.2 is the fix.

What is HEIF Heist? A bug that could have allowed us to - Dump of OpenAI private repositories https://hacktron.ai/blog/hacking-openai - RCE on Slack which allows leaking files https://www.youtube.com/shorts/AUE9U1ABdxc - RCE in Meta https://github.com/strukturag/libheif/security/advisories/GHSA-2jg2-4ch7-h545 's core product suite via image upload - Leak arbitrary Redacted users' tokens, and AWS access tokens - Authenticated RCE on Discourse https://github.com/discourse/discourse/security/advisories/GHSA-vhm9-85gw-x335 - Unauthenticated RCE in Next.js https://vercel.com/changelog/nextjs-august-2026-security-release via AVIF Image Optimization - Authenticated RCE on GitHub Enterprise CVE-2026-19118 https://docs.github.com/en/enterprise-server@3.21/admin/release-notes 3.21.5-security-fixes - RCE on multiple web frameworks/cms. - Leak user's files, and sensitive info from multiple applications. HEIF Heist is Hacktron's name for a class of remote attack paths targeting services that decode attacker-controlled HEIF, HEIC, or AVIF images. By exploiting underlying native libraries, these vulnerabilities allow an attacker to bypass application-level defenses and trigger memory corruption, data exposure, or remote code execution RCE . The vulnerable attack surface lives below the application layer inside native C/C++ decoders such as libheif https://github.com/strukturag/libheif and libde265 https://github.com/strukturag/libde265 . These parsers typically enter production environments indirectly bundled via higher-level wrappers like ImageMagick, libvips, or Sharp, standard distro packages, and prebuilt container base images. By probing upload endpoints with crafted .avif or .heic files, an attacker can fingerprint the remote libheif version family in use. Once identified, they can fire an exact version-matched n-day or 0-day payload to trigger memory corruption, data exfiltration, or remote code execution. Research origin HEIF Heist began as part of the Hacktron research team's broader security research into frontier labs https://hacktron.ai/blog . After discovering and reporting a libheif https://github.com/strukturag/libheif RCE in Discourse https://github.com/discourse/discourse/security/advisories/GHSA-vhm9-85gw-x335 , we asked a larger question: how many other applications depend on the same image-processing stack? Past vulnerabilities such as ImageTragick https://imagetragick.com , ForcedEntry https://www.trendmicro.com/en gb/research/21/i/analyzing-pegasus-spywares-zero-click-iphone-exploit-forcedentry.html , and the libwebp flaw https://citizenlab.ca/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/ have demonstrated the reach of an image processor or parser vulnerability. An image parser might generate an operating-system thumbnail or process a web upload, giving it an enormous blast radius. That initial finding grew into a multi-month investigation tracing libheif across communication platforms, cloud services, enterprise products, and popular web frameworks. FAQ Why is it called HEIF Heist? Even when Remote Code Execution RCE isn't immediately achievable, the attack primitives may still allow arbitrary heap disclosure, letting an attacker “heist” in-memory data such as other users' data and environment variables. What makes it unique? The vulnerability sits inside native C/C++ parsers libheif / libde265 , making it completely language and framework-agnostic. Any backend processing untrusted user image uploads is potentially exposed to these parsers. What versions are affected, and how do I fix it? HEIF Heist is not tied to a single version. It targets an entire ecosystem of vulnerabilities across multiple release families e.g. 1.19.x, 1.20.x, 1.22.x, 1.23.x . Any deployment lacking the latest upstream security patches is potentially vulnerable. - Update upstream. Upgrading to libheif v1.23.2 https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497 or later and the latest libde265 , via your distribution's security channel or a direct source build, is recommended to patch known 0-day and n-day vectors. - Defense in depth. Given the complexity of the ISO base media file format and the pace of decoder updates, future memory-safety flaws are likely. Production architectures should disable untrusted HEIF/AVIF decoding where it is not needed, or isolate image-processing pipelines inside hardened, ephemeral sandboxes. Separately, if you self-host Discourse https://github.com/discourse/discourse/security/advisories/GHSA-vhm9-85gw-x335 or Next.js https://vercel.com/changelog/nextjs-august-2026-security-release , ensure you are on the latest release and follow their security advisories. Is it easy to exploit? These are not out-of-the-box exploits. Exploitation requires fingerprinting the target version and tailoring the payload image s . Some of our RCE attempts landed only after thousands of image uploads. That said, an AI agentic approach with a frontier model like GPT-5.6 Sol cut exploit development time down to roughly 1 to 3 days from initial probe to remote RCE. A motivated attacker can convert a vulnerable upload endpoint into RCE or an info leak. Who found it? Led by Harsh Jaiswal, alongside Mohan SRK, Rahul Maini, and Sudhanshu Rajbhar from the Hacktron research team, assisted by Hacktron Harness, GPT-5.6 Sol, and Opus 5. Work with the team behind this research. Hacktron brings together top CTF researchers, experienced red teamers, and offensive security researchers. We use AI to accelerate security research, finding and eliminating vulnerabilities in widely trusted software before malicious actors do. We're continuing our research across frontier labs and other internet-critical systems. If you're responsible for securing one of them, we'd like to work with you.