HEIF Heist: Remote Code Execution Vulnerabilities Exploited in Major Platforms

• •HEIF Heist exploits vulnerabilities in image parsers libheif and libde265.
• •Major platforms like Meta, Slack, and GitHub Enterprise are affected.
• •CVE-2026-19118 allows authenticated remote code execution in GitHub Enterprise.

The HEIF Heist refers to a class of vulnerabilities affecting image-processing libraries like libheif and libde265, allowing attackers to execute remote code through malicious HEIF, HEIC, or AVIF files. Disclosed by Hacktron, this issue impacts major platforms including Meta, Slack, and GitHub Enterprise, highlighting a significant supply chain risk in applications that rely on native image decoders. The vulnerabilities can lead to heap disclosure, sensitive data exposure, and account compromise. Notable CVEs include CVE-2026-19118, which allows authenticated RCE in GitHub Enterprise, and CVE-2026-84383, a critical heap-buffer overflow in libheif. Hacktron's research began with an investigation into OpenAI's Discourse platform, revealing a chain of vulnerabilities that could compromise user accounts. The attack surface is extensive, as many applications unknowingly utilize these vulnerable libraries through higher-level frameworks. Current recommendations include upgrading to the latest versions of affected libraries to mitigate risks.