Perhaps this is the exploit chain (they mention libheif at the start of their exploit chain) https://www.hacktron.ai/blog/hacking-openai and HN discussion

Perhaps this is the exploit chain (they mention libheif at the start of their exploit chain) https://www.hacktron.ai/blog/hacking-openai and HN discussion https://news.ycombinator.com/item?id=49749656