Security researchers have disclosed “HEIF Heist,” a collection of image-parsing flaws that could let attackers turn vulnerable upload services into pathways for data theft, account compromise, and remote code execution.
The research focuses on weaknesses in software used to decode HEIF, HEIC, and AVIF images. These modern image formats are widely used by phones, web applications, cloud platforms, and content-management systems.
A maliciously crafted image uploaded to a vulnerable service could trigger memory-corruption bugs while the application processes it.
Researchers from Hacktron said the issue affects vulnerable deployments using libheif and libde265, two libraries used to decode high-efficiency image formats.
The researchers described scenarios in which attackers could bypass application-level security controls because the attack code is hidden inside a seemingly normal image file.
Malicious Image Uploads Spawn Shells
The researchers said corrupted image files can exploit memory-management errors in the decoding process. Depending on the affected application and deployment, the flaw could enable arbitrary heap memory disclosure or remote code execution.
Heap disclosure is especially dangerous because it may expose sensitive data temporarily stored in application memory. This can include environment variables, access tokens, user data, credentials, encryption keys, and internal service information.
“Even when Remote Code Execution isn’t immediately achievable, the attack primitives may still allow arbitrary heap disclosure,” the researchers wrote.
In practical terms, an attacker may not need to immediately obtain a remote shell to cause serious damage. Leaked tokens or secrets could allow access to cloud accounts, source-code repositories, internal APIs, or connected third-party services.
Hacktron’s report named several potential targets, including enterprise software, web frameworks, GitHub Enterprise servers, Discourse forums, cloud environments, and large online platforms.
The real-world impact depends on whether a platform accepts user-controlled images and uses an unpatched decoder in its processing pipeline.
The research team said it used AI systems from Anthropic and OpenAI to help identify and analyze vulnerable code paths.
Hacktron credited human researchers Harsh Jaiswal, Mohan SRK, Rahul Maini, and Sudhanshu Rajbhar, with assistance from its internal Harness platform and AI models.
In a separate proof-of-concept involving OpenAI, researchers said they chained two vulnerabilities, including an image-parser flaw, to compromise employee accounts.
They reported that this access enabled them to reach internal repositories and submit a pull request to OpenAI’s centralized monorepo using compromised Codex credentials, cyberscoop said.
According to the researchers, the initial flaw was identified on July 25 and patched within days. They said the full attack chain, from vulnerability discovery to repository access, took less than 72 hours. OpenAI awarded the team a $6,500 bug bounty.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
