AI-generated editorial illustration; not a documentary photograph.
Hacktron researchers have disclosed an image-decoding vulnerability they call HEIF Heist, which they say can trigger memory corruption in software using libheif and libde265. CyberScoop reported on September 18, 2026 that crafted HEIF, HEIC or AVIF uploads could expose in-memory data and, under some conditions, enable remote code execution. The latest libheif release has been patched, according to the researchers, but deployments missing current upstream security fixes may remain exposed.
Image Uploads Become an Attack Path
The reported attack targets how the decoding libraries process specially prepared image files. Because applications commonly inspect uploaded images through these components, a malicious file may reach the vulnerable decoder after passing application-level defenses. The resulting memory corruption could reveal user data, access tokens and environment variables even when an attacker cannot immediately achieve code execution.
The researchers identified potential exposure across services and frameworks associated with AWS, Meta, GitHub Enterprise and Discourse. These findings describe possible attack paths in affected deployments, not evidence that those companies suffered malicious breaches through the flaw.
OpenAI Account Chain Demonstrated
In one proof of concept, the team chained an image-parser weakness with another vulnerability to compromise OpenAI employee accounts and reach internal repositories. Using an employee's Codex credentials, the researchers opened a pull request in OpenAI's shared monorepo. They said the chain took less than 72 hours to develop after the initial flaw was found on July 25, and OpenAI awarded a $6,500 bug bounty.
AI Assisted the Research
Hacktron attributed the work to human researchers assisted by Hacktron Harness, GPT-5.6 Sol and Opus 5, involving systems from OpenAI and Anthropic. The team said this agent-assisted process reduced exploit development from the initial probe to remote code execution to roughly one to three days.
Exploitation was not described as automatic or consistently reliable. An attacker would need to identify the target's decoder version and tailor the image payload, while some remote-code-execution attempts required thousands of uploads. Operators using libheif should therefore confirm that deployed versions include the latest upstream security patches, including copies embedded in other services or frameworks.
Source: Researchers use AI to find widespread software decoder flaw
SIGNAL TITANS
Leave a Reply