HEIF Heist Flaw in Image Decoders Could Enable Data Theft and Remote Code Execution
Summary
Researchers found that malicious HEIF, HEIC, and AVIF files could exploit flaws in libheif and libde265. The issue was patched, but unpatched deployments may remain at risk; researchers also reported using a chained flaw to access OpenAI repositories.
Key points
- Researchers said malicious HEIF, HEIC, or AVIF files could trigger memory corruption in libheif and libde265, potentially enabling data disclosure or remote code execution.
- The researchers identified OpenAI, AWS, Meta, GitHub Enterprise, and Discourse as potentially at risk; the article does not establish that all were vulnerable or compromised.
- Researchers reported chaining two vulnerabilities to access OpenAI employee accounts and internal repositories, and demonstrated access by opening a pull request using an employee’s Codex credentials.
- The researchers said the flaw was discovered July 25 and patched within days; deployments without the latest upstream security patches may remain vulnerable.
- The researchers received a $6,500 bug bounty from OpenAI for their work.
- The researchers said AI tools helped reduce exploit-development time to roughly one to three days, while exploitation could require target-version fingerprinting and many tailored image uploads.
Article Details
- Vulnerability Types
- Memory corruption in image-decoding software
- Arbitrary heap disclosure
- Remote code execution
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
People
Harsh JaiswalHacktron researcher involved in discovering and reporting HEIF Heist.Mohan PedhapatiHacktron researcher who co-authored a description of the OpenAI account-compromise research.Mohan SRKHacktron researcher involved in discovering and reporting HEIF Heist.Rahul MainiHacktron researcher involved in discovering and reporting HEIF Heist.Sudhanshu RajbharHacktron researcher involved in discovering and reporting HEIF Heist.
Vendors
AnthropicResearchers used Anthropic’s Claude and OpenAI’s Codex to uncover HEIF Heist, a flaw in popular image decoding libraries that could expose sensitive data and enable remote access across major platforms.OpenAIResearchers used Anthropic’s Claude and OpenAI’s Codex to uncover HEIF Heist, a flaw in popular image decoding libraries that could expose sensitive data and enable remote access across major platforms.
Products
ChatGPT“Until two months ago, a user or OpenAI employee logging into OpenAI’s own help forum could have had their ChatGPT and Codex accounts taken over,” the researchers wrote.ClaudeResearchers used Anthropic’s Claude and OpenAI’s Codex to uncover HEIF Heist, a flaw in popular image decoding libraries that could expose sensitive data and enable remote access across major platforms.CodexResearchers used Anthropic’s Claude and OpenAI’s Codex to uncover HEIF Heist, a flaw in popular image decoding libraries that could expose sensitive data and enable remote access across major platforms.GPT-5.6 SolAttribution for the research is described as being “led” by the Hacktron human researchers “assisted by Hacktron Harness, GPT-5.6 Sol, and Opus 5.”libde265They warned that vulnerable deployments of libheif and libde265 could put OpenAI, AWS, Meta, GitHub Enterprise, and Discourse systems at risk if patches are not applied.libheifThey warned that vulnerable deployments of libheif and libde265 could put OpenAI, AWS, Meta, GitHub Enterprise, and Discourse systems at risk if patches are not applied.Opus 5Attribution for the research is described as being “led” by the Hacktron human researchers “assisted by Hacktron Harness, GPT-5.6 Sol, and Opus 5.”