Hacktron discloses HEIF Heist, a remote code execution flaw in HEIC/AVIF image parsers

Security researchers at Hacktron identified a class of vulnerabilities, dubbed HEIF Heist, affecting native decoders like libheif and libde265 that process HEIF, HEIC, and AVIF image formats. These libraries are widely bundled inside popular tools such as ImageMagick, libvips, and Sharp, meaning the flaw can reach production systems through indirect dependencies rather than direct use.