HEIF Heist Image Flaws Let Attackers Gain RCE Across Meta, Slack and GitHub Enterprise

“HEIF Heist,” a broad class of image-processing attack paths that could allow threat actors to turn malicious HEIF, HEIC, and AVIF uploads into remote code execution, sensitive-data exposure, and account compromise across major technology and enterprise platforms.

The research, published by Hacktron, highlights a familiar but increasingly dangerous supply-chain weakness: applications often trust native image-decoding components hidden beneath higher-level frameworks and services.

In this case, the affected attack surface stems from memory-unsafe C/C++ parsers, chiefly libheif and libde265, which are commonly reached through ImageMagick, libvips, Sharp, Linux distribution packages, and container images.

HEIF Heist is not described as a single vulnerability or one universal exploit. Instead, it encompasses multiple bugs and version-dependent attack paths in the HEIF/AVIF decoding ecosystem.

Depending on the target environment, the outcome may range from arbitrary heap disclosure to full remote code execution.

“The attack primitives may still allow arbitrary heap disclosure,” the Hacktron team said, warning that attackers could steal in-memory data such as environment variables, user information, access tokens, and cloud credentials even when direct code execution is not immediately achievable.

The potential impact spans widely used online services and developer platforms. Hacktron said it demonstrated or identified paths involving remote code execution in Slack, Meta’s core product suite, GitHub Enterprise Server, Discourse, and several web frameworks.

The researchers also cited unauthenticated RCE in .js through AVIF image optimization, as well as exposure affecting Node.js and Ruby on Rails ecosystems, including Astro and Gatsby deployments that process untrusted image files.

One disclosed finding, tracked as CVE-2026-19118, concerns authenticated remote code execution in GitHub Enterprise.

The report also alleges the possibility of leaking user files and sensitive data from multiple applications, demonstrating how image upload features can become a route into backend infrastructure rather than merely a content-processing function.

Hacktron’s research began with an investigation involving OpenAI’s Discourse-based community forum.

The team said it chained a libheif image-parser flaw with an OpenAI single sign-on issue to compromise multiple employee ChatGPT accounts on July 25, 2026.

According to the researchers, the Discourse upload pipeline passed HEIC and HEIF files to ImageMagick for conversion , exposing attacker-controlled content to libheif.

They identified a heap buffer overflow that enabled out-of-bounds read/write primitives during decoding and subsequently developed an RCE path against the environment.

The researchers said they used the compromised employee’s Codex account to create a harmless proof-of-concept pull request in OpenAI’s internal openai/openai monorepo, avoiding access to sensitive source code.

OpenAI reportedly fixed the issue 14 hours after submission and awarded a $6,500 bounty for the OpenAI-side finding.

Discourse separately released remediation guidance and added image-processing sandboxing as a defense-in-depth measure.

The incident illustrates a critical identity risk: a compromise of an internet-facing service tied to enterprise SSO can become a stepping stone to connected developer tools, source-control platforms, messaging systems, and email.

Cyberscoop Researchers said that , an attacker can submit a crafted image to a vulnerable upload or processing endpoint, fingerprint the decoder version in use, and tailor a payload that causes memory corruption.

HEIF Heist Image Flaws

Hacktron said the theoretical scope included linked GitHub, Slack, and email accounts.

The researchers credited human-led work assisted by Hacktron Harness, OpenAI’s GPT-5.6 Sol, and Anthropic Claude models.

They said AI systems helped analyze packages, identify missing security backports, develop exploit primitives, and adapt payloads to distinct targets.

Exploitability still required significant target-specific work. Payloads needed to be matched to the decoder, library, allocator, and runtime environment, and some RCE attempts required thousands of uploaded images.

However, Hacktron said agentic workflows reduced the route from an initial probe to RCE to roughly one to three days, sharply lowering the operational cost of weaponizing memory-corruption bugs.

That finding aligns with wider warnings from security leaders that AI-assisted research is accelerating faster than enterprise remediation.

Security teams increasingly face a “patch Tuesday, exploit Wednesday” problem as automated systems reduce the expertise and time traditionally required to convert disclosed flaws into working attacks.

Organizations should immediately inventory every application and container that accepts or transforms HEIF, HEIC, or AVIF content.

This includes public file-upload workflows, web image optimization services, media conversion jobs, CMS platforms, chat systems, developer portals, and API endpoints.

Hacktron recommends upgrading to the latest security-patched libheif and libde265 packages.

The team noted that upstream libheif version 1.23.4 contained further security maintenance fixes as of September 14, 2026, while distributions may ship patched packages using older version strings with backported fixes.

Administrators should therefore verify vendor advisories rather than rely only on an upstream version number.

Security teams should also turn off untrusted HEIF and AVIF processing where it is unnecessary, rebuild affected self-hosted Discourse installations, restrict risky formats through ImageMagick policy, and isolate image conversion workloads in hardened, ephemeral sandboxes.

Treating image decoding as a high-risk native-code execution boundary not a routine upload feature will be essential as AI makes exploit development faster and cheaper.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

Artificial Intelligence

Cyber security Course

Cyber Security Resources

Cybersecurity

Information Gathering

Information Security Risks

10 Malicious npm Packages Linked to Runtime Malware Campaign With Millions of Downloads

PAYLOAD Ransomware Abuses Active Directory Group Policy to Disrupt Entire Windows Domain

New Rapuncel Infostealer Abuses Microsoft-Signed Driver to Disable 145 Security Tools

BigDiskBuster Windows Defender DoS Vulnerability Blocks Platform and Signature Updates

North Korea’s Hangro VPN Certificate Exposes Internal Network and Russia-Linked Infrastructure

Hackers Abuse Microsoft Teams to Pose as IT Support and Steal Employee Passwords