HEIF Heist: an attack on image decoders threatens entire ecosystems

The Hacktron team has presented research titled HEIF Heist — the name they gave to an entire class of remote attacks on services that decode attacker-controlled images in the HEIF, HEIC and AVIF formats. The point is that the vulnerabilities live not in the application code but lower down — in native C/C++ libraries like libheif and libde265, which make their way into production indirectly: through wrappers such as ImageMagick, libvips or Sharp, standard distribution packages, and ready-made container images.

How it works

By uploading specially crafted .avif or .heic files to public intake endpoints, an attacker first takes a "fingerprint" — determining the version family of libheif on the server. After that they can apply a payload precisely tailored to the version (n-day or 0-day) and trigger memory corruption, data leakage or remote code execution.

The name alludes to the fact that even when full-fledged RCE is out of reach, the attack primitives often still allow reading arbitrary regions of the heap — that is, "heisting" other people's data and environment variables, including access tokens, out of memory.

Scale

The research began with the discovery of an RCE in libheif inside Discourse, after which the team wondered how many other applications rely on the same image-processing stack. Months of work uncovered problems in communication platforms, cloud services, enterprise products and popular web frameworks. Among the claimed results are an unauthenticated RCE in Next.js via AVIF image optimization, an RCE in GitHub Enterprise (CVE-2026-19118), as well as chains leading to the leakage of files and tokens from a number of systems. The authors recall past high-profile stories of the same kind — ImageTragick, ForcedEntry and the libwebp vulnerability — underscoring the enormous "blast radius" of bugs in image parsers.

Not trivial, but real

The researchers are honest in their caveats: there are no ready-made, out-of-the-box exploits here. You have to determine the target's version and pick a payload, and some RCEs succeeded only after thousands of uploads. That said, an agentic approach using a cutting-edge model cut exploit development time to one to three days — from the first attempt to remote code execution.

The problem is not tied to a single version: entire release lines are affected (1.19.x, 1.20.x, 1.22.x, 1.23.x). As a defense, it is recommended to update libheif to version 1.23.2 or newer and to pull a fresh libde265 through the distribution's security channels. Where decoding of untrusted HEIF/AVIF is not needed, they advise disabling it, and isolating the image-processing pipelines themselves in ephemeral sandboxes, since new memory bugs in such a complex format are all but inevitable.

Source: Lobsters