One image parser sits under Slack, Discourse, Next.js and GitHub

Serguey Asael Shinder21 September 2026, 08:012 min read

Hacktron has published HEIF Heist, a name for a class of remote attacks on services that decode attacker-supplied HEIF, HEIC or AVIF images. The disclosure site is at https://heif-heist.com, and its claimed results include unauthenticated remote code execution in Next.js via AVIF image optimization, authenticated RCE on GitHub Enterprise (CVE-2026-19118), authenticated RCE on Discourse, RCE in Meta's core product suite via image upload, a dump of OpenAI private repositories, RCE on Slack allowing file leaks, and token and AWS credential leaks across several applications.

The mechanism is the part worth reading. The vulnerable surface is not in any of those applications. It is in the native C and C++ decoders below them — libheif and libde265 — which arrive indirectly, bundled through higher-level wrappers like ImageMagick, libvips and Sharp, through distribution packages, and through prebuilt container base images. Nobody in the dependency chain necessarily decided to support HEIC.

And the attack has a reconnaissance step that makes it practical: by probing an upload endpoint with crafted .avif or .heic files, an attacker can fingerprint the libheif version family in use, then fire a payload matched to that exact version — an n-day if one exists, a 0-day otherwise.

The CVE is checkable. NVD records CVE-2026-19118 as published on 1 September, CVSS 3.1 base score 7.5 (High), a time-of-check-time-of-use race in GitHub Enterprise Server requiring an authenticated user with write access and precise timing of concurrent uploads, affecting all versions before 3.22 and fixed in 3.17.20, 3.18.14, 3.19.11, 3.20.7 and 3.21.5.

What it means

The question to ask is not "do we support HEIC" but "what decodes the files we accept". An application that accepts image uploads and calls a thumbnailer has a native decoder in its process or its container, chosen by a wrapper library, selected by the file's magic bytes rather than by its extension. Rejecting .heic at the form does nothing if the decoder sniffs content.

Version fingerprinting through an upload endpoint is the detail that turns a bug into a campaign. Without it an attacker guesses and crashes things noisily. With it, the exploit is selected after the target has identified itself — which is why a class of memory-safety bugs in a decoder becomes a repeatable path across unrelated products.

This is the third time the industry has learned the same lesson from an image parser. ImageTragick, ForcedEntry and the libwebp flaw all had the same shape: a small native library, embedded everywhere, reached by untrusted bytes, running in the same process as everything else. The durable fixes are the unglamorous ones — decode out of process, drop privileges, cap dimensions and memory, and keep an inventory of what your container actually links against.