Cybersecurity researchers have identified a widespread vulnerability in popular software decoders that could lead to remote code execution and data theft across major internet platforms, enterprise services, and web frameworks. The flaw, dubbed "HEIF Heist," exploits memory corruption errors when processing specially crafted image files, potentially allowing attackers to bypass application layer defenses.
The vulnerability affects `libheif` and `libde265`, two common C and C++ libraries used for parsing image files such as HEIF, HEIC, and AVIF. By uploading malicious image files, an attacker could trigger memory corruption, leading to remote code execution or arbitrary heap disclosure, which could expose sensitive in-memory data like user information and environment variables.
Researchers from Hacktron, including Harsh Jaiswal, Mohan SRK, Rahul Maini, and Sudhanshu Rajbhar, discovered the flaw. Their research was notably assisted by artificial intelligence systems, specifically OpenAI's Codex and Anthropic's Claude, as well as frontier models like GPT-5.6 Sol and Opus 5. They claim that an AI agentic approach significantly reduced exploit development time.
The potential impact of HEIF Heist is broad, according to the researchers. It could enable access to internal OpenAI repositories, leak user files and access tokens from services like Amazon Web Services, and grant remote code execution privileges on platforms including Meta's core product suite, GitHub Enterprise servers, and the Discourse internet forum.
In one proof-of-concept demonstration, the researchers detailed how chaining two vulnerabilities, including the image parser flaw, allowed them to compromise OpenAI employee accounts. With access to these accounts, they gained entry to OpenAI's internal repositories and even opened a pull request in the company's monorepo using an employee's Codex credentials. OpenAI confirmed this incident and paid a $6,500 bug bounty for the discovery.
The flaw was discovered on July 25 and patched within days. The researchers reported that the entire attack chain, from initial vulnerability discovery to gaining repository access, took less than 72 hours. They also noted that an OpenAI help forum user or employee could have had their ChatGPT and Codex accounts compromised, potentially exposing connected services like GitHub, Slack, and email.
While the latest version of `libheif` has been patched, any deployment not running the most recent security updates remains vulnerable. The researchers acknowledged that exploiting the flaw is not trivial, requiring specific fingerprinting of target versions and tailored image payloads. Some remote code execution attempts required thousands of image uploads. However, they emphasized that a motivated attacker could still convert a vulnerable upload endpoint into a remote code execution or information leak vector.
