libheif

Reported Context (3)

OpenAI fixed the issue quickly and paid a bounty, while the underlying HEIF/HEIC flaw was tied to libheif and affected Discourse-based systems. Researchers Used Claude Opus 5 to Chain Flaws and Access OpenAI Staff Accounts
They warned that vulnerable deployments of libheif and libde265 could put OpenAI, AWS, Meta, GitHub Enterprise, and Discourse systems at risk if patches are not applied. HEIF Heist Flaw in Image Decoders Could Enable Data Theft and Remote Code Execution
Discourse’s built-in image checks didn’t support the HEIC/HEIF photo format, so uploads in that format were passed to ImageMagick, exposing an unpatched flaw in the libheif library it relies on for decoding. Researchers Chained AI-Built Exploit and Sign-In Flaw to Access OpenAI Repositories

CVE (1)

People (5)

MITRE ATT&CK (3)

Vendors (3)

Products (11)

Tools (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.