HEIF HeistSkip to reportHEIF HeistOne image parser to pwn them all01 Overview02 Research origin03 FAQWhat is HEIF Heist?A bug that could have allowed us toDump of OpenAI private repositoriesRCE on Slack which allows leaking filesRCE in Meta's core product suite via image uploadLeak arbitrary Redacted users' tokens, and AWS access tokensAuthenticated RCE on DiscourseUnauthenticated RCE in Next.js via AVIF Image OptimizationAuthenticated RCE on GitHub Enterprise (CVE-2026-19118)RCE on multiple web frameworks/cms.Leak user's files, and sensitive info from multiple applications.HEIF Heist is Hacktron's name for a class of remote attack paths targeting services that decode attacker-controlled HEIF, HEIC, or AVIF images. By exploiting underlying native libraries, these vulnerabilities allow an attacker to bypass application-level defenses and trigger memory corruption, data exposure, or remote code execution (RCE).The vulnerable attack surface lives below the application layer inside native C/C++ decoders such as libheif and libde265. These parsers typically enter production environments indirectly bundled via higher-level wrappers like ImageMagick, libvips, or Sharp, standard distro packages, and prebuilt container base images.By probing upload endpoints with crafted .avif or .heic files, an attacker can fingerprint the remote libheif version family in use. Once identified, they can fire an exact version-matched n-day or 0-day payload to trigger memory corruption, data exfiltration, or remote code execution.Research originEverything up top is resting on something underneath.HEIF Heist began as part of the Hacktron research team's broader security research into frontier labs. After discovering and reporting a libheif RCE in Discourse, we asked a larger question: how many other applications depend on the same image-processing stack?Past vulnerabilities such as ImageTragick, ForcedEntry, and the libwebp flaw have demonstrated the reach of an image processor or parser vulnerability. An image parser might generate an operating-system thumbnail or process a web upload, giving it an enormous blast radius.That initial finding grew into a multi-month investigation tracing libheif across communication platforms, cloud services, enterprise products, and popular web frameworks.FAQWhy is it called HEIF Heist?Even when Remote Code Execution (RCE) isn't immediately achievable, the attack primitives may still allow arbitrary heap disclosure, letting an attacker “heist” in-memory data such as other users' data and environment variables.What makes it unique?The vulnerability sits inside native C/C++ parsers (libheif / libde265), making it completely language and framework-agnostic. Any backend processing untrusted user image uploads is potentially exposed to these parsers.What versions are affected, and how do I fix it?HEIF Heist is not tied to a single version. It targets an entire ecosystem of vulnerabilities across multiple release families (e.g. 1.19.x, 1.20.x, 1.22.x, 1.23.x). Any deployment lacking the latest upstream security patches is potentially vulnerable.Update upstream. Upgrading to libheif v1.23.2 or later and the latest libde265, via your distribution's security channel or a direct source build, is recommended to patch known 0-day and n-day vectors.Defense in depth. Given the complexity of the ISO base media file format and the pace of decoder updates, future memory-safety flaws are likely. Production architectures should disable untrusted HEIF/AVIF decoding where it is not needed, or isolate image-processing pipelines inside hardened, ephemeral sandboxes.Separately, if you self-host Discourse or Next.js, ensure you are on the latest release and follow their security advisories.Is it easy to exploit?These are not out-of-the-box exploits. Exploitation requires fingerprinting the target version and tailoring the payload image(s). Some of our RCE attempts landed only after thousands of image uploads. That said, an AI agentic approach with a frontier model like GPT-5.6 Sol cut exploit development time down to roughly 1 to 3 days from initial probe to remote RCE. A motivated attacker can convert a vulnerable upload endpoint into RCE or an info leak.Who found it?Led by Harsh Jaiswal, alongside Mohan SRK, Rahul Maini, and Sudhanshu Rajbhar from the Hacktron research team, assisted by Hacktron Harness, GPT-5.6 Sol, and Opus 5.Work with the team behind this research.Hacktron brings together top CTF researchers, experienced red teamers, and offensive security researchers. We use AI to accelerate security research, finding and eliminating vulnerabilities in widely trusted software before malicious actors do. We're continuing our research across frontier labs and other internet-critical systems. If you're responsible for securing one of them, we'd like to work with you.Book a callExplore HacktronStay connected with usX ↗·LinkedIn ↗·RSS ↗

HEIF Heist refers to a class of remote attack vectors targeting services that process HEIF, HEIC, or AVIF images. The vulnerability stems from exploiting flaws within the underlying native C/C++ decoding libraries, such as libheif and libde265, which operate beneath the application layer. These native parsers are frequently incorporated into production environments indirectly through higher-level wrappers like ImageMagick, libvips, or Sharp, or are bundled within standard distribution packages and container base images. By exploiting these inherent weaknesses, an attacker can bypass application-level security measures to trigger memory corruption, expose sensitive data, or achieve remote code execution.

The mechanism of the attack relies on probing upload endpoints with specially crafted AVIF or HEIC files to fingerprint the specific version of the libheif version family currently in use by the target system. Once the version is identified, the attacker can deploy an exact version-matched payload designed to trigger the underlying memory corruption or data leakage within the decoder. This vulnerability is inherently language and framework agnostic because the flaw resides in the native image parsing code, meaning any backend processing of untrusted user image uploads can be exposed to this threat. Even when remote code execution is not immediately possible, the attack primitives allow for arbitrary heap disclosure, enabling an attacker to "heist" in-memory data, including sensitive user information and environment variables.

The research origin of HEIF Heist emerged from Hacktron's broader security investigation into frontier labs. This investigation sought to determine the scope of image processor or parser vulnerabilities, building upon previous discoveries such as flaws in ImageTragick, ForcedEntry, and the libwebp. The research traced the libheif vulnerability across numerous communication platforms, cloud services, enterprise products, and web frameworks, demonstrating an enormous blast radius for image processing flaws. This initial finding evolved into a multi-month investigation tracing these deep vulnerabilities across various systems.

The vulnerability is not tied to a single release version but targets an entire ecosystem of weaknesses across multiple release families. To mitigate these risks, the primary recommendation involves updating upstream components, such as upgrading libheif to version 1.23.2 or later along with the latest libde265, through distribution security channels or direct source builds. Furthermore, organizations should adopt a defense in depth strategy by disabling untrusted HEIF/AVIF decoding where it is not strictly necessary, or by isolating image-processing pipelines within hardened, ephemeral sandboxes. For self-hosted environments like Discourse or Next.js, ensuring the use of the latest releases and adhering to security advisories is also critical.

While exploitation requires careful fingerprinting and payload tailoring, the process can be significantly accelerated by leveraging AI agentic approaches, which can reduce exploit development time substantially. The research was conducted by the Hacktron team, led by Harsh Jaiswal, alongside Mohan SRK, Rahul Maini, and Sudhanshu Rajbhar, utilizing resources such as Hacktron Harness, GPT-5.6 Sol, and Opus 5 to accelerate the discovery and elimination of these vulnerabilities.