3 ms·
HEIF Heist: image parser RCE exploit
- K0nserv 8d agoThe one thing you'd expect on a website like this: how the exploit works, is missing. The entire thing feels like marketing.
- neuronexmachina 8d agoI mean, they kind of do? I assume they're hesitant to write a how-to on how to tailor the exploit image: >These are not out-of-the-box exploits. Exploitation requires fingerprinting the target version and tailoring the payload image(s). Some of our RCE attempts landed only after thousands of image uploads. That said, an AI agentic approach with a frontier model like GPT-5.6 Sol cut exploit development time down to roughly 1 to 3 days from initial probe to remote RCE. A motivated attacker can convert a vulnerable upload endpoint into RCE or an info leak.
- K0nserv 8d agoI was under the impression the underlying issue has been patched. If it hasn't, this page and their initial blog post seem irresponsible. If it has indeed been patched why not provide a detailed write up?
- owebmaster 8d agoIs this the new way to go viral ? Registering a domain and vibecode the content
- canucker2016 8d agoPerhaps this is the exploit chain (they mention libheif at the start of their exploit chain) https://www.hacktron.ai/blog/hacking-openai and HN discussion https://news.ycombinator.com/item?id=49749656