AI Aids Discovery of Widespread Software Decoder Flaw
Researchers leveraged AI models to uncover HEIF Heist, a critical vulnerability in libheif and libde265 decoders, enabling memory corruption and potential remote code execution.
Researchers have utilized advanced AI models, including Anthropic's Claude and OpenAI's Codex, to identify a significant vulnerability dubbed "HEIF Heist" within widely used software decoding libraries. This flaw resides in libheif and libde265, which are crucial for processing image formats like HEIF, HEIC, and AVIF. The vulnerability allows attackers to trigger memory corruption by submitting specially crafted image files, potentially leading to severe security breaches.
The implications of HEIF Heist are far-reaching, as it could expose major internet platforms, enterprise services, and web frameworks to data theft and unauthorized remote access. The researchers highlighted potential impacts on services such as Amazon Web Services (AWS), Meta's product suite, GitHub Enterprise, and the open-source forum Discourse. Even in scenarios where full remote code execution is not immediately achieved, the attack primitives can facilitate arbitrary heap disclosure, enabling attackers to exfiltrate sensitive in-memory data, including other users' information and environment variables.
The discovery process itself was heavily influenced by AI. The Hacktron research team, credited with leading the effort, was "assisted by Hacktron Harness, GPT-5.6 Sol, and Opus 5." This reliance on AI systems, including frontier models, demonstrates a new frontier in cybersecurity research, where artificial intelligence plays a pivotal role in identifying complex vulnerabilities.
At its core, the attack exploits how C and C++ software parsing tools within libheif and libde265 process image files. By uploading malicious HEIF, HEIC, or AVIF files, attackers can bypass many application-layer defenses. This bypass can, in numerous cases, grant attackers remote code execution privileges for accounts or products associated with major AI and tech companies.
While the libheif library has reportedly been patched in its latest version, the researchers caution that any deployment not running the most recent security updates remains susceptible. A proof-of-concept demonstrated by the researchers involved chaining two vulnerabilities, including the image parser flaw, to compromise OpenAI employee accounts. This access allowed them to reach internal OpenAI repositories, even submitting a pull request to the company's monorepo using compromised credentials.
OpenAI acknowledged the researchers' findings and awarded them a bug bounty of $6,500. The researchers noted that the entire exploit chain, from initial discovery to gaining repository access, was completed in under 72 hours. They also pointed out that an AI agentic approach significantly accelerated the exploit development process, reducing it to approximately one to three days from initial probing to achieving remote code execution.
Despite the severity of the vulnerability, the researchers indicated that exploitation is not trivial, requiring specific targeting and tailored payloads. However, they stressed that a motivated attacker could convert a vulnerable upload endpoint into a full remote code execution or information leak vulnerability, especially with AI assistance to streamline the process.
The discovery of HEIF Heist underscores the growing sophistication of cyber threats and the evolving landscape of vulnerability research, where AI is becoming an indispensable tool for both offense and defense. The widespread use of affected libraries means that vigilance and prompt patching remain critical for organizations across the digital ecosystem.