Hacktron's AI Agents Found a Decoder Flaw That Opened Meta and OpenAI to Remote Code Execution

Hacktron researchers found a decoder bug that let a crafted image file reach remote code execution on products from Meta and OpenAI.

They nicknamed the flaw HEIF Heist. It lives in libheif and libde265, the libraries that parse HEIF, HEIC, and AVIF files, CyberScoop reported. Nobody has confirmed a mass outbreak, and the write-up stopped short of a finished CVE assignment.

A successful parse can yield remote code execution or heap disclosure, including other users' data, tokens and environment variables. Demonstrated impact paths include Meta's core product suite, GitHub Enterprise, Discourse, AWS-tied tokens, and a related chain into OpenAI employee accounts. Human researchers led the work, with AI systems helping find the decoder bug.

Upstream libheif is patched. The researchers said they found the flaw about 25 July 2026 and that it was patched within days. Hacktron said some remote-code-execution attempts landed only after thousands of image uploads, because the payload has to match the target version. Any deployment still missing the latest upstream patch remains potentially vulnerable.

The OpenAI employee-account path and the $6,500 bounty on that chain are already covered in Hacktron's Claude and OpenAI source-code disclosure. That write-up is the employee-account half of the same Hacktron research, not a second decoder bug.

Some offers on this page may be paid placements or contain affiliate links.