HEIF Heist: libheif image decoder bugs exposed Slack, Meta and OpenAI to RCE

One decoding stack, many targets

Security researchers have published details of "HEIF Heist," a collection of attack paths that abuse bugs in the native C and C++ image decoders libheif and libde265 to compromise services that process HEIF, HEIC or AVIF images supplied by users. According to the researchers' write-up, which reached Hacker News's front page on September 18, the bugs could have been used to gain remote code execution on Slack, inside Meta's core product suite, on GitHub Enterprise and on Discourse, to steal files and tokens from multiple applications, and even to dump OpenAI's private repositories.

The work comes from the Hacktron research team — Harsh Jaiswal, Mohan SRK, Rahul Maini and Sudhanshu Rajbhar — who describe a multi-month investigation that started after they found and reported a libheif remote code execution flaw in Discourse, then asked how many other products sit on the same image-processing stack.

How the attack chain works

The vulnerable code is not in the applications themselves but in the decoders underneath them. Those libraries usually reach production indirectly: bundled through higher-level wrappers such as ImageMagick, libvips or Sharp, installed as standard distribution packages, or baked into prebuilt container base images. The result is a dependency almost nobody audits directly but almost everybody exposes to user uploads.

The attack flow the researchers describe starts by probing an upload endpoint with malformed .avif or .heic files. Because different libheif versions respond differently to crafted input, an attacker can work out which version family the remote service runs and then send a payload matched to that exact version — either a known n-day or a fresh zero-day — to trigger memory corruption, data exfiltration or full remote code execution.

Even where code execution is not immediately reachable, the researchers say the primitives often allow reading data from the process heap, including other users' information and environment variables. That is where the "heist" in the name comes from.

Who is affected

The write-up lists a long set of demonstrated impacts: remote code execution on Slack with the ability to leak files; code execution in Meta's core product suite via image upload; leakage of user tokens and AWS access credentials; authenticated RCE on Discourse; unauthenticated RCE in Next.js through its AVIF image optimization feature; authenticated RCE on GitHub Enterprise, tracked as CVE-2026-19118; RCE across several web frameworks and content management systems; and access to OpenAI's private repositories.

These claims come from the researchers' own site rather than coordinated vendor advisories, and the names of some affected targets are redacted in the published list.

Exploitation effort and AI assistance

This is not a turnkey exploit. The researchers note that a working attack requires fingerprinting the target's decoder version and tailoring payload images accordingly, and that some code execution attempts succeeded only after thousands of image uploads. They also claim that an agentic workflow built around a frontier model cut exploit development time to roughly one to three days from initial probe to remote code execution — an illustration of how AI tooling is compressing the timeline between finding and weaponizing memory-safety bugs.

Fixes and mitigations

HEIF Heist is not tied to a single release but spans multiple libheif version families, including 1.19.x, 1.20.x, 1.22.x and 1.23.x. Any deployment missing the latest upstream security patches is potentially vulnerable, the researchers say.

Their recommendations are to update to libheif v1.23.2 or later and the newest libde265 through distribution security channels or a source build; to switch off untrusted HEIF and AVIF decoding wherever it is not genuinely needed; and to isolate image-processing pipelines in hardened, disposable sandboxes, on the grounds that the complexity of the ISO base media file format makes further memory-safety flaws likely. Operators self-hosting Discourse or Next.js should be on the latest releases and follow those projects' security advisories.

Why it matters

The most consequential vulnerability in a modern web service can sit several layers below its own code. Image decoding is one of the few places where nearly every backend deliberately parses untrusted binary input with memory-unsafe C/C++ libraries, and those libraries arrive indirectly through wrappers, distro packages and base images that most engineering teams never inventory.

The pattern echoes earlier parser incidents such as ImageTragick, ForcedEntry and the libwebp flaw: one low-level library, thousands of dependent products, and a single bug class that crosses languages and frameworks because the weakness lives below them. For platform teams, the practical lessons are to know exactly which decoder, at which version, is reachable from which upload path, and to assume the parser will keep producing bugs — which makes sandboxing and aggressive patch cadence as important as any individual CVE.