“Even when Remote Code Execution isn’t immediately achievable, the attack primitives may still allow arbitrary heap disclosure, letting an attacker ‘heist’ in-memory data such as other users’ data and environment variables,” wrote Hacktron researchers Harsh Jaiswal, Mohan SRK, Rahul Maini and Sudhanshu Rajbhar.
How HEIF Heist works
Researchers at Hacktron described a class of memory-corruption attacks they nicknamed HEIF Heist. The attack targets how common decoding libraries parse HEIF, HEIC and AVIF image formats. By uploading image files specifically corrupted with malicious code, an attacker can trigger memory-corruption errors in widely used decoders—most notably libheif and libde265—potentially allowing theft of in-memory data or, in some cases, remote code execution (RCE).
The report lays out a broad set of potential consequences from successful exploitation: access to internal repositories, leaking user files and access tokens, and the ability to gain RCE across multiple online services. The researchers identified possible impacts spanning major AI and tech brands, including access to internal OpenAI repositories, data from Amazon Web Services, Meta’s core product suite, GitHub Enterprise servers and the open-source forum Discourse.
How Hacktron used AI models in their research
Hacktron’s disclosure explicitly credits multiple AI systems for accelerating the investigation. The human-led research was “assisted by Hacktron Harness, GPT-5.6 Sol, and Opus 5,” and the write-up notes reliance on Anthropic’s Claude and OpenAI’s Codex. The researchers described these as “frontier models” and said an “AI agentic approach with a frontier model like GPT-5.6 Sol cut exploit development time down to roughly 1 to 3 days from initial probe to remote RCE.”
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadThe OpenAI incident: timeline and proof of concept
The researchers documented a concrete chain of events against OpenAI. According to their timeline, the flaw was discovered on July 25 and patched within days. In a Sept. 13 blog post, Hacktron researchers Harsh Jaiswal, Rahul Maini and Mohan Pedhapati described chaining two vulnerabilities—including an image parser flaw—to compromise OpenAI employee accounts and reach internal repositories.
As a proof of concept, the team said they opened a pull request in OpenAI’s “monorepo” using the compromised employee’s Codex credentials. The entire attack, from discovering the initial vulnerability to gaining repository access, took less than 72 hours, the researchers reported. OpenAI issued a bug bounty payment of $6,500 to the researchers, and CyberScoop has reached out to OpenAI for additional comment.
Exploitation difficulty, patching, and the role of deployment drift
The researchers emphasized that the attack paths they found were not trivial to exploit. Successful exploitation required fingerprinting the target version of the decoder and tailoring payload images. Some RCE attempts required thousands of image uploads before succeeding. At the same time, they warned that automation with high‑capability models can shorten development time from weeks to days, and that a motivated attacker could convert a vulnerable upload endpoint into RCE or an information leak.
Hacktron noted that libheif’s latest version has been patched, but cautioned that “any deployment lacking the latest upstream security patches is potentially vulnerable.” That distinction—between a fixed upstream library and real-world deployments that lag—remains central to the risk profile the researchers outlined.
What this means for OpenAI, Meta, and GitHub Enterprise
- OpenAI: The company was the subject of a chained exploit demonstration that led to repository access; the researchers report the flaw was discovered July 25 and patched within days, and that a pull request was opened in the monorepo as proof of concept.
- Meta and GitHub Enterprise: Both are named as examples of services for which the researchers found potential remote code execution attack paths if their upload endpoints were backed by vulnerable decoders.
- Cloud providers and services (AWS): The researchers flagged the potential to leak access tokens and user files tied to online services such as Amazon Web Services when attackers can extract in-memory secrets.
The ledger the researchers present is precise: a patched upstream library does not eliminate risk unless deployments apply those patches, and AI tools can materially shorten exploit development time in real-world conditions.
HEIF Heist frames a blunt operational question for organizations that accept user uploads or integrate image parsing libraries: are your decoder binaries up to date, and can you detect the unusual, high-volume probing patterns the researchers say preceded some successful RCE attempts? The Hacktron disclosure makes clear that the answers will determine whether a flagged vulnerability remains a theoretical risk—or a live one.
https://cyberscoop.com/hacktron-ai-heif-heist-vulnerability/
