Hacktron team says a libheif image bug reached OpenAI, Slack and many web apps that accept HEIC uploads, patched to 1.23.4

The security team at Hacktron published a report on 17 September 2026 describing a heap buffer overflow in libheif, the open-source HEIC and AVIF decoder, that gave them remote code execution on any web application that processes user-uploaded HEIC or AVIF images through ImageMagick with a vulnerable libheif installed. The report reached 132 points on Hacker News in three hours.

The immediate action is to update libheif to version 1.23.4 or newer, either through a distribution security channel or the upstream release, and to update libde265 alongside it. Hacktron says libheif 1.23.2 has been superseded by further security fixes and that distribution packages may carry backported patches under an older upstream version number, so a team should check the package advisory for its distribution as well as the upstream version.

Hacktron says its "HEIF Heist" research project traced the same class of vulnerability across products that use libheif at some level, including Slack, Meta, GitHub Enterprise, Ruby on Rails, and Node.js frameworks such as Next.js, Astro and Gatsby. Hacktron writes that any application that processes user-controlled images and accepts HEIC, HEIF or AVIF is highly likely to be affected. This is a claim by Hacktron based on its own testing.

What the bug does

The report says libheif contained a heap buffer overflow reachable from a specially crafted HEIC image, leading to out-of-bounds read and write during HEIC decoding. The upstream code that fixed the underlying condition had been changed the previous year, but the commit was not documented as a security fix and received no CVE, which is why Debian 12 (libheif 1.19.7) and Debian 13 (1.19.8) shipped without a backport at the time. Debian has since published a security update. Discourse's own Docker image was based on Debian 12 and therefore installed the vulnerable version.

The demonstration

Hacktron says it chained the libheif RCE with an SSO misconfiguration in OpenAI's identity infrastructure. Discourse, which OpenAI uses for community.openai.com, allowed sign-in with OpenAI accounts. A working exploit against the Discourse image upload therefore reached OpenAI accounts, including employee accounts whose Codex was connected to OpenAI's internal GitHub organisation. Hacktron says it opened one proof-of-concept pull request in an internal repository, then stopped. OpenAI paid a $6,500 bounty on 1 September 2026 and confirmed the SSO-side fix roughly 14 hours after the initial submission. Discourse published a security advisory (GHSA-vhm9-85gw-x335) with patch and rebuild guidance and added ImageMagick sandboxing as defence in depth.

What the exploit cost

Hacktron writes that the HEIF Heist research cost less than $3,000 in tokens across two months, used three researchers, and adapted the exploit to each new company in one or two days. Hacktron says Claude Opus 4.8 struggled to produce a working exploit with ASLR enabled, and the same problem was solved within hours of Anthropic releasing Claude Opus 5. That is Hacktron's own account of one campaign, but the point is worth noting: the labour cost of turning a memory-corruption bug into a reliable remote exploit has dropped.

What to do

Update libheif and libde265 from the distribution security channel or from upstream. Discourse operators who self-host should run git pull and ./launcher rebuild app from their Discourse directory, because rebuilding is what replaces the underlying Docker image; a web-interface update on its own may not. Anywhere HEIF or AVIF decoding is not needed, disable it in the image processor's security policy, or isolate the image pipeline inside a sandbox. ImageMagick's security policy supports restricting accepted formats.

Source

Hacking OpenAI at Hacktron. Discourse advisory: GHSA-vhm9-85gw-x335. Debian security update: DSA-6417-1. Hacker News discussion at item 49749656.