HEIF Heist: libheif flaws reach OpenAI, Slack, Meta and Next.js

HEIF Heist is Hacktron AI's name for a class of attacks on services that decode images people upload in the HEIF, HEIC or AVIF formats. The flaws sit in libheif and libde265, image decoders written in C and C++ that most applications never call directly. They arrive bundled inside image tools such as ImageMagick, libvips and Sharp, in standard distribution packages, and in prebuilt container images. Because the bug lives below the application, Hacktron's research site says it does not depend on programming language or framework: any backend that processes untrusted image uploads through these decoders is potentially exposed.

Hacktron announced the research as uncovering attack paths affecting OpenAI, Slack, Meta, GitHub Enterprise, Rails, Next.js, ImageMagick and others. Its site frames the list as what the bug could have allowed: dumping OpenAI private repositories, remote code execution on Slack and in Meta's core product suite through image upload, unauthenticated remote code execution in Next.js through its AVIF image optimization, and authenticated remote code execution on GitHub Enterprise, tracked as CVE-2026-19118. Remote code execution means an attacker can run their own commands on the server. The investigation grew out of a libheif flaw Hacktron found and reported in Discourse. An earlier item covers how Hacktron chained a HEIF image bug into an OpenAI account takeover, and Vercel's account describes reproducing, disclosing and fixing the libheif vulnerability with Hacktron and the maintainers. The site does not give per-platform technical details.

The attacks are targeted rather than automatic. An attacker first uploads crafted .avif or .heic files to work out which libheif version family a service runs, then sends a payload matched to that version, using either a known but unpatched flaw or a previously unknown one. Hacktron says these are not out-of-the-box exploits and some of its remote code execution attempts landed only after thousands of image uploads, but it also says an agentic approach with GPT-5.6 Sol cut exploit development to roughly one to three days from first probe. Even when code execution fails, the bugs may let an attacker read heap memory, such as other users' data and environment variables, which is the heist in the name.

Hacktron recommends upgrading to libheif 1.23.2 or later and the latest libde265, and, because it expects more memory-safety flaws in these decoders, disabling untrusted HEIF and AVIF decoding where it is not needed or running image processing inside hardened, short-lived sandboxes. It separately tells self-hosters of Discourse and Next.js to move to the latest release. A team that accepts image uploads should check which libheif its image stack pulls in, since the vulnerable code can sit several layers below anything it installed on purpose.