Project
Open-source C++ library for encoding and decoding HEIF/HEIC image files, used across apps and services for image processing.
Hacktron chained a heap overflow in libheif to an OpenAI SSO flaw and opened a pull request in OpenAI's internal monorepo in under 72 hours. The bug had been fixed upstream a year earlier, but the fix never reached Debian's packages.
Reality
The libheif bug was fixed upstream a year earlier without a security label or a CVE, so a Discourse image check that ignored HEIC left it reachable, and forum sign-in tokens carried full API access to the accounts behind them.
Perspective Coverage
6 publishersReality
The affected releases stretch back to Next.js 13.4, and for Windows self-hosters the only remedy Vercel offers is the version bump. The AVIF bug shipped in the same release at least has a config gate.
Reality
The image parsing bug had been fixed upstream about a year earlier, and the decision not to ship that fix belonged to Discourse. OpenAI's forum shared single sign-on with internal systems, so a forum account became GitHub access.
Perspective Coverage
9 publishersReality
libheif v1.23.5 fixes a high-rated flaw that let a 351-byte AVIF file force decoder allocations of more than 10 GB. It is a drop-in replacement for v1.23.4 and also closes six lower-rated memory-handling bugs.
Reality
An open-source gateway author walked Hacktron's five-step path into OpenAI through his own seven detection layers. The first two hops are requests to a forum and an identity provider. Where the gateway is deployed decides what any of it can read.
Reality
Cisco says CVE-2026-76460 is under active exploitation. It scores 10.0, needs no credentials, and puts an unauthenticated attacker past the web management interface of an Identity Services Engine appliance.
Reality
Hacktron's report puts the vulnerable code in libheif, two dependency steps below an ImageMagick call on OpenAI's Discourse forum, and says the upstream fix never went through the usual security advisory process.
Reality
The project's own README puts the 2026 advisory count at 37 and the maintenance roster at one independent developer with almost no recurring funding. Products that decode HEIC or AVIF inherit that pace.
Reality
Hacktron's path into OpenAI's internal repos ran through a libheif bug Debian had not backported and a single sign-on flow that trusted community.openai.com. The dev.to breakdown says the model changed what the attack cost. The category of attack was the same either way.
Reality
One converted iPhone photo decoded in Playwright's WebKit and failed in Chromium and Firefox. A three-line createImageBitmap call tells an upload component which case it has before it draws the box.
Reality
The HTML spec mandates the silent substitution, blob.type is the only record that it happened, and a user-agent lookup table cannot stand in for the check.
Reality