GoKawiilHacktron discloses HEIF Heist, a remote code execution flaw in HEIC/AVIF image parsers
Security researchers at Hacktron identified a class of vulnerabilities, dubbed HEIF Heist, affecting native decoders like libheif and libde265 that process HEIF, HEIC, and AVIF image formats. These libraries are widely bundled inside popular tools such as ImageMagick, libvips, and Sharp, meaning the flaw can reach production systems through indirect dependencies rather than direct use.
GoKawiil's interpretation of the reporting above, not reported fact.
Because these decoders sit beneath the application layer, standard app-level security checks can't catch malicious files before they trigger memory corruption or code execution. Attackers can fingerprint the exact decoder version via upload endpoints and deploy version-specific exploits, making any service that processes user-uploaded images a potential target until patched.
- HEIF Heist exploits native image-parsing libraries like libheif and libde265, not the applications that call them.
- These libraries are often hidden dependencies inside common tools like ImageMagick, libvips, and Sharp.
- Attackers can fingerprint the decoder version through upload endpoints and launch targeted n-day or 0-day exploits.
Source: heif-heist.com, 2026-09-18
Published there as: “HEIF Heist: image parser RCE exploit”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.