HEIF Heist is a security research initiative by Hacktron targeting a class of vulnerabilities in native image decoders like libheif and libde265. Exploits against these underlying libraries have led to authenticated and unauthenticated RCE, data leaks, and token theft across major platforms including GitHub Enterprise, Next.js, Discourse, Slack, and Meta's products.
Background
HEIF/HEIC/AVIF are increasingly common image formats, with libheif as a widely adopted open-source decoder bundled into many high-level image processing libraries. Previous incidents like ImageTragick and ForcedEntry have shown the broad impact of image parser vulnerabilities.
- Source
- Lobsters
- Published
- Sep 20, 2026 at 01:56 PM
- Score
- 8.0 / 10