Reported by 2 outlets

Timeline

1. original reporting

   HEIF Heist Image Flaws Let Attackers Gain RCE Across Meta, Slack and GitHub Enterprise

   gbhackers.com · 22d ago · September 21st, 2026

   “HEIF Heist,” a broad class of image-processing attack paths that could allow threat actors to turn malicious HEIF, HEIC, and AVIF uploads into remote code execution, sensitive-data exposure, and account compromise across major technology and enterprise platforms. The research, published by Hacktron, highlights a familiar but increasingly dangerous supply-chain weakness: applications often trust native image-decoding […] The post HEIF Heist Image Flaws Let Attackers Gain RCE Across Meta, Slack and GitHub Enterprise appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   One Malicious Image Can Turn Vulnerable Upload Services Into Remote Shells

   cyberpress.org · 22d ago · September 21st, 2026

   Security researchers have disclosed “HEIF Heist,” a collection of image-parsing flaws that could let attackers turn vulnerable upload services into pathways for data theft, account compromise, and remote code execution. The research focuses on weaknesses in software used to decode HEIF, HEIC, and AVIF images. These modern image formats are widely used by phones, web applications , cloud platforms, and content-management systems. A maliciously crafted image uploaded to a vulnerable service could trigger memory-corruption bugs while the application processes it. Researchers from Hacktron said the issue affects vulnerable deployments using libheif and libde265, two libraries used to decode high-efficiency image formats. The researchers described scenarios in which attackers could bypass application-level security controls because the attack code is hidden inside a seemingly normal image file. Malicious Image Uploads Spawn Shells The researchers said corrupted image files can exploit memory-management errors in the decoding process. Depending on the affected application and deployment, the flaw could enable arbitrary heap memory disclosure or remote code execution. Heap disclosure is especially dangerous because it may expose sensitive data temporarily stored in application memory. This can include environment variables, access tokens, user data, credentials, encryption keys, and internal service information. “Even when Remote Code Execution isn’t immediately achievable, the atta