HEIC image upload vulnerability: from forum photo to OpenAI repos

An iPhone photo format was the way in. Security researchers at Hacktron have described how a crafted HEIC file uploaded to OpenAI's community forum gave them code execution on the server, and how a single sign-on misconfiguration then turned that into control of OpenAI employees' ChatGPT and Codex accounts. It is the clearest recent example of a HEIC image upload vulnerability becoming a company-wide breach — and any application that accepts photos from users has the first half of that chain.

How the HEIC image upload vulnerability was exploited

According to Hacktron's disclosure, the team began reviewing the image-upload pipeline of Discourse, the forum software behind community.openai.com, on 23 July 2026. Discourse normally checked images with a library called FastImage. FastImage did not support HEIF, so HEIC and HEIF files were handed to ImageMagick for conversion instead — exposing the libheif decoding library directly to files an attacker controlled.

The Discourse Docker image was built on Debian 12, which shipped libheif 1.19.7. An upstream change that fixed the relevant code the previous year had not been labelled as a security fix and received no CVE, so the fix had not been backported. The result was a heap buffer overflow during HEIC decoding. By the morning of 25 July, the researchers had remote code execution through an image upload.

The second link was identity. OpenAI's forum used "Sign in with OpenAI". Hacktron says an SSO misconfiguration meant that controlling the forum allowed takeover of the ChatGPT and Codex accounts of people who logged into it, without any interaction from them. The researchers took over an OpenAI employee's account whose Codex was connected to OpenAI's GitHub organisation and asked Codex to open a harmless pull request in OpenAI's internal monorepo as proof. Then they stopped.

The timeline and the response

• Under 72 hours from initial discovery to access to OpenAI's repository.
• About 14 hours after the report, OpenAI confirmed its side was fixed.
• Over a weekend, Discourse received the report on Saturday, replied on Sunday and had a fix by Monday, and began sandboxing ImageMagick.
• $6,500 bounty paid by OpenAI.

OpenAI added a clarification to the post: testing against the Discourse-hosted forum was explicitly excluded from its bug bounty programme, and the award recognises the OpenAI-side SSO finding, not the actions against Discourse. Hacktron, for its part, stresses that the escalation was not Discourse-specific: any compromised service using OpenAI's SSO would have led to the same access.

Discourse published advisory GHSA-vhm9-85gw-x335 with patch and rebuild guidance.

What is the libheif vulnerability?

libheif is the open-source library that decodes HEIF images, the container format behind iPhone HEIC photos and, with a different codec, AVIF. Hacktron has since expanded the work into a project it calls HEIF Heist, tracing libheif through Slack, Meta, GitHub Enterprise, Ruby on Rails and Node.js frameworks including Next.js, Astro and Gatsby. The researchers say the issue is not tied to one version but spans several release families, and that any deployment without the latest upstream security patches is potentially vulnerable. As of 14 September 2026 they list v1.23.4 as the latest upstream security release.

Their summary is blunt: if your application processes user-controlled images and accepts .heic, .heif or .avif files, it is highly likely to be affected.

Are HEIC image uploads dangerous?

The format is not the problem; parsing untrusted files with complex native code is. Image decoders are large C and C++ codebases that interpret intricate binary formats, and they run on whatever users upload. HEIF is newer and less battle-tested than JPEG or PNG, and, as this case shows, fixes can reach distributions slowly. Hacktron reports that only one company it tested noticed the activity, even after thousands of images were sent and image processors repeatedly crashed.

The researchers also note that AI models did much of the exploit development, and that the whole multi-company campaign cost under $3,000 in tokens. Whatever you make of that, the economics of turning a memory bug into a working exploit have changed.

How to secure user image uploads

For teams running web or mobile back ends that accept photos, the practical checklist is short:

1. Know your decoder. Find out which library actually processes each accepted format. As Discourse's case shows, the answer can differ by file type within one pipeline.
2. Accept only what you need. If your product does not need HEIC or AVIF, reject them. If it does, consider converting on the client, where the phone already decodes its own photos, before upload.
3. Restrict ImageMagick. Its security policy can limit accepted formats and resource use. Most installations never set one.
4. Sandbox image processing. Run decoding in a separate, unprivileged, short-lived process or container with no network access and no credentials. A compromise then yields an empty box. Our write-up on sandbox boundaries that held and failed covers the isolation options.
5. Patch the image, not just the app. Discourse warns that self-hosters must rebuild their Docker image; a web-interface update alone may not replace the vulnerable system library. The same is true of any containerised app: dependency fixes in the base image only arrive when you rebuild.
6. Watch for crashes. Repeated decoder crashes on upload are a signal, not noise.

Can a forum compromise single sign-on?

It can if the identity design lets it. The second half of this chain is arguably the more important lesson. A community forum is a low-value system that sits next to high-value ones through SSO. Any application that relies on a shared identity provider should ensure that compromising one relying application cannot mint or replay sessions for another, and that sessions for internal staff on public-facing tools are isolated from their internal access. We saw a similar pattern of low-value surfaces reaching high-value secrets in GitHub Actions prompt injection and the Forgejo template repository RCE.

If your product accepts user uploads, our web app development team can review the upload pipeline, and our QA and automation practice can add malformed-file testing to CI so the next decoder bug is caught before an attacker finds it.