HEIF Heist: image parser RCE exploit
7 hours ago
- HEIF Heist is a class of remote attack paths targeting services that decode attacker-controlled HEIF, HEIC, or AVIF images.
- It exploits native C/C++ libraries like libheif and libde265, bypassing application-level defenses to cause memory corruption, data exposure, or remote code execution (RCE).
- The vulnerable attack surface is below the application layer, often introduced indirectly via wrappers such as ImageMagick, libvips, Sharp, or prebuilt container images.
- Attackers can fingerprint the remote libheif version by probing upload endpoints with crafted .avif or .heic files, then deploy version-matched n-day or 0-day payloads.
- The research began after discovering and reporting a libheif RCE in Discourse, expanding into a multi-month investigation across communication platforms, cloud services, and web frameworks.
- The name 'Heist' reflects the ability to 'heist' in-memory data (e.g., other users' data, environment variables) via arbitrary heap disclosure, even without achieving RCE.
- The vulnerability is language- and framework-agnostic, affecting any backend that processes untrusted user image uploads.
- It is not tied to a single version; multiple release families are affected. Upgrading to libheif v1.23.2+ and the latest libde265 is recommended, along with disabling untrusted HEIF/AVIF decoding or isolating image-processing pipelines.
- Exploitation is not out-of-the-box; it requires fingerprinting and tailoring payloads, but AI assistance can reduce development time to roughly 1–3 days from probe to remote RCE.
- The research was led by Hacktron's team, including Harsh Jaiswal, Mohan SRK, Rahul Maini, and Sudhanshu Rajbhar, with assistance from Hacktron Harness, GPT-5.6 Sol, and Opus 5.