HEIF Heist
One image parser to pwn them all
What is HEIF Heist?
A bug that could have allowed us to
HEIF Heist is Hacktron's name for a class of remote attack paths targeting services that decode attacker-controlled HEIF, HEIC, or AVIF images. By exploiting underlying native libraries, these vulnerabilities allow an attacker to bypass application-level defenses and trigger memory corruption, data exposure, or remote code execution (RCE).
The vulnerable attack surface lives below the application layer inside native C/C++ decoders such as libheif and libde265. These parsers typically enter production environments indirectly bundled via higher-level wrappers like ImageMagick, libvips, or Sharp, standard distro packages, and prebuilt container base images.
By probing upload endpoints with crafted .avif or .heic files, an attacker can fingerprint the remote libheif version family in use. Once identified, they can fire an exact version-matched n-day or 0-day payload to trigger memory corruption, data exfiltration, or remote code execution.
Research origin
HEIF Heist began as part of the Hacktron research team's broader security research into frontier labs. After discovering and reporting a libheif RCE in Discourse, we asked a larger question: how many other applications depend on the same image-processing stack?
Past vulnerabilities such as ImageTragick, ForcedEntry, and the libwebp flaw have demonstrated the reach of an image processor or parser vulnerability. An image parser might generate an operating-system thumbnail or process a web upload, giving it an enormous blast radius.
That initial finding grew into a multi-month investigation tracing libheif across communication platforms, cloud services, enterprise products, and popular web frameworks.
FAQ
Why is it called HEIF Heist?
Even when Remote Code Execution (RCE) isn't immediately achievable, the attack primitives may still allow arbitrary heap disclosure, letting an attacker “heist” in-memory data such as other users' data and environment variables.
What makes it unique?
The vulnerability sits inside native C/C++ parsers (libheif / libde265), making it completely language and framework-agnostic. Any backend processing untrusted user image uploads is potentially exposed to these parsers.
What versions are affected, and how do I fix it?
HEIF Heist is not tied to a single version. It targets an entire ecosystem of vulnerabilities across multiple release families (e.g. 1.19.x, 1.20.x, 1.22.x, 1.23.x). Any deployment lacking the latest upstream security patches is potentially vulnerable.
- Update upstream. Upgrading to
libheifv1.23.2 or later and the latestlibde265, via your distribution's security channel or a direct source build, is recommended to patch known 0-day and n-day vectors. - Defense in depth. Given the complexity of the ISO base media file format and the pace of decoder updates, future memory-safety flaws are likely. Production architectures should disable untrusted HEIF/AVIF decoding where it is not needed, or isolate image-processing pipelines inside hardened, ephemeral sandboxes.
Separately, if you self-host Discourse or Next.js, ensure you are on the latest release and follow their security advisories.
Is it easy to exploit?
These are not out-of-the-box exploits. Exploitation requires fingerprinting the target version and tailoring the payload image(s). Some of our RCE attempts landed only after thousands of image uploads. That said, an AI agentic approach with a frontier model like GPT-5.6 Sol cut exploit development time down to roughly 1 to 3 days from initial probe to remote RCE. A motivated attacker can convert a vulnerable upload endpoint into RCE or an info leak.
Who found it?
Led by Harsh Jaiswal, alongside Mohan SRK, Rahul Maini, and Sudhanshu Rajbhar from the Hacktron research team, assisted by Hacktron Harness, GPT-5.6 Sol, and Opus 5.
Work with the team behind this research.
Hacktron brings together top CTF researchers, experienced red teamers, and offensive security researchers. We use AI to accelerate security research, finding and eliminating vulnerabilities in widely trusted software before malicious actors do. We're continuing our research across frontier labs and other internet-critical systems. If you're responsible for securing one of them, we'd like to work with you.