Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
Source
Karim Rahal
Author
Karim Rahal
Date
Key takeaways · AI-distilled
The actual remote-code-execution bug lived in libheif, an AVIF decoder used far beyond Next.js (also ImageMagick, WordPress, sharp) -- Next.js was just one reachable path via its <Image> component to sharp to libvips to libheif.
Vercel mitigated the issue platform-wide in one day (Aug 13) by disabling AVIF optimization in its central Image Optimization Service, before any upstream fix existed.
Fixing it took multi-party disclosure across sharp, libvips, and libheif maintainers; libheif shipped the patch (v1.23.2) six days after a cross-team sync, and Next.js moved up an already-planned release by a day to ship its own AVIF-disabling mitigation sooner.
For context windowThe maximum amount of text a model can consider at once — its working memory for the current conversation or task.Full definition →, GitHub's private vulnerability reports grew 6x in 2026 (500/week in January to 3,000/week in May), a scale the piece attributes partly to LLMs accelerating vulnerability research.
Terms in this piece · Glossary
context window — The maximum amount of text a model can consider at once — its working memory for the current conversation or task.
Why it matters
An RCE vulnerability in libheif, an AVIF decoder used by Next.js, sharp, libvips, ImageMagick and WordPress, was reachable through Next.js image optimization; Vercel deployed a platform-wide mitigation while coordinating an upstream fix with maintainers.
