libheif bugs reached OpenAI repos and GitHub Enterprise

Hacktron's proof that the break-in worked was a pull request. The researchers took over an OpenAI employee's account, asked that employee's Codex to open PR #1186742 in the internal openai/openai monorepo, and stopped there, so they would never read any internal code.

The way in was an image. Hacktron has now published the wider research as HEIF Heist on Heif-heist: a crafted .heic or .avif upload that, the team says, could have dumped OpenAI's private repositories, leaked files through Slack, and run code inside Meta's core product suite.

At a glance

• On GitHub Enterprise the authenticated remote code execution carries CVE-2026-19118; in Next.js the same decoder gives unauthenticated RCE through AVIF Image Optimization, and Discourse was the first confirmed target.
• The bug sits below the app, in the C and C++ decoders libheif and libde265, which reach production bundled inside ImageMagick, libvips or Sharp, distro packages and container base images.
• None of it is point-and-click: some RCE attempts landed only after thousands of uploads, though Hacktron says an agentic run with GPT-5.6 Sol cut exploit development to roughly one to three days.

If you have not followed image-parser bugs, the pattern is old. Hacktron points to ImageTragick, ForcedEntry and the libwebp flaw as precedent, because a parser that builds a thumbnail or handles a web upload has an enormous blast radius. Snyk describes the 2023 libwebp bug, CVE-2023-4863, as a CVSS 9.6 flaw found by Apple's Security Engineering and Architecture team with The Citizen Lab and fixed by upgrading to libwebp 1.3.2.

Discourse handed HEIC files straight to ImageMagick

On July 23, 2026, Hacktron started reading Discourse's image-upload pipeline. Discourse checked images with FastImage, but FastImage does not support HEIF, so those files went to ImageMagick's magick command for conversion, which put attacker-controlled bytes directly in front of libheif.

An Opus 4.8 session inspecting the Discourse Docker image found that some libheif security fixes had not been backported, giving a heap buffer overflow with out-of-bounds read and write during HEIC decoding. The upstream code had been changed the previous year, but the commit was not documented as a security fix and received no CVE. Discourse's image was based on Debian 12 and installed libheif 1.19.7; Debian 13 still shipped the vulnerable 1.19.8 at the time, and Debian published its Debian 13 security update on August 8, 2026.

An SSO flaw turned a forum account into repository access

Hacktron writes that until two months before its September 13, 2026 post, any user or OpenAI employee logging into community.openai.com could have had their ChatGPT and Codex accounts taken over. Since people connect services to Codex and ChatGPT, the reachable scope included GitHub, Slack and email.

The whole run, from first discovery to access to an OpenAI repository, took under 72 hours. Hacktron reported the initial issue to OpenAI and Discourse and worked with them on the patch; OpenAI paid a $6,500 bounty. The team stresses that the escalation bug is an OpenAI SSO issue rather than a Discourse-specific one: any first-party or third-party service behind that SSO would have given the same access. Discourse received the report on a Saturday, replied on Sunday, had a fix by Monday and began sandboxing ImageMagick.

Opus 5 shipped that evening, and the exploit worked by morning

On July 24 Opus 4.8 produced a working ImageMagick and libheif code-execution exploit with ASLR disabled, and several follow-up sessions failed to make it reliable against Discourse's default configuration with ASLR enabled. Anthropic released Claude Opus 5 that evening. A fresh session produced a working ARM64 exploit for a local Mac within three hours, then ported it to the x86-64 and jemalloc setup Discourse uses; local RCE through an image upload was confirmed by 6:00 a.m. on July 25.

The team then put the model in an autonomous /goal loop against its own Discourse Cloud instance, proxied through rce.ee/ctf-forum to look like a CTF target, because Opus refused to write exploits for remote instances. By 10:00 a.m. the agent had RCE and proved it by reading /etc/hosts. The same script then worked against OpenAI's instance.

The broader campaign against Slack, Zoom, Meta and others took two months, cost less than $3,000 in tokens and ran with three researchers, with one or two days to adapt the exploit per company. Hacktron says it is not aware of any company detecting the activity except Shopify, even after thousands of images and repeated image-processor crashes.

A crafted upload tells the attacker which libheif is running

The surface is language and framework agnostic, because the vulnerable code is the native decoder rather than the web stack above it. An attacker first probes an upload endpoint with crafted .avif or .heic files to fingerprint the remote libheif version family, then fires a payload matched to that exact family, an n-day or a 0-day, triggering memory corruption, data exposure or code execution.

It is the difference between rattling a door and reading the lock's brand off the keyhole before cutting a key. Even when a shell does not fall out, Hacktron says the same primitives can disclose heap memory, which is where the heist in the name comes from: other users' data, environment variables, tokens. The listed results include arbitrary user token and AWS access token leaks, and RCE across multiple web frameworks and CMSes. Harsh Jaiswal led the work with Mohan SRK, Rahul Maini and Sudhanshu Rajbhar, assisted by Hacktron Harness, GPT-5.6 Sol and Opus 5.

The write-ups name targets but not much detail: which Meta products, which Slack paths, which redacted service gave up the AWS tokens, and no version range accompanies CVE-2026-19118 on GitHub Enterprise. In our view the uncomfortable part is upstream hygiene, since the commit that mattered carried no CVE and no security label, which Hacktron suggests is why Debian 12 and 13 missed the backports in time.

Rebuild Discourse, then rethink AVIF

Hacktron's patch notice tells self-hosters to run git pull and then ./launcher rebuild app from /var/discourse, because a web-interface update alone may leave the old Docker image with its vulnerable libheif in place; Discourse-hosted customers are already patched. Upstream the advice is libheif v1.23.2 or later plus the latest libde265, and the OpenAI post adds that as of September 14, 2026 the latest security release is v1.23.4. Hacktron expects further memory-safety flaws and says the research continues; the next targets are not named.