View Ridge Security
Back to Cyber Hose

AI-assisted research uncovers critical libheif heap flaw enabling RCE

A CVSS 9.8 libheif heap flaw found via AI leads this run, plus a Check Point root RCE and CareCam camera password cracking.

🕵️ RESEARCH & DEEP DIVES

  • AI-assisted research uncovers critical libheif heap flaw (CVE-2026-84383) enabling RCE and data theft CVE-2026-84383
    Researchers used AI models to discover a critical heap out-of-bounds write in libheif that enabled RCE and data theft, since patched in version 1.23.2.
    • Applies to users of libheif (HEIF/AVIF image decoder) versions 1.22.0 through 1.23.1; deployments lacking upstream patches remain potentially vulnerable.
    • The flaw (CVE-2026-84383, CVSS 9.8) is a heap out-of-bounds write triggered by crafted HEIF, HEIC, or AVIF files using nested iden and auxl item references, causing mixed bit-depth Alpha plane corruption.
    • Attackers upload malicious image files to vulnerable parsing endpoints, bypassing application-layer defenses to achieve remote code execution or arbitrary heap disclosure of in-memory data like tokens and user files.
    • Hacktron researchers, assisted by AI models including GPT-5.6 Sol and Opus 5, demonstrated compromise of OpenAI employee accounts reaching internal repositories, and outlined risks to Meta, GitHub Enterprise, AWS, and Discourse.
    • Exploitation was difficult, requiring version fingerprinting and thousands of image uploads in some cases, but AI-assisted exploit development cut the process to roughly 1–3 days.
    Sources 📄 Source: heif-heist.com · 📎 Coverage: cyberscoop.com · 👁 via CyberScoop, thehackerwire.com (discovered)

🔓 CVEs & KEV

  • CVE-2026-84383 — strukturag libheif — CVSS 9.8 — libheif Critical Heap OOB Write via Crafted HEIF/AVIF (CVE-2026-84383)

  • CVE-2026-85497 — CareCam HMT.CM2507 Firmware — CVSS 9.3 — CareCam CM2507 IP Camera Root Password Cracking (CVE-2026-85497)

  • CVE-2026-81180 — Syslifters sysreptor — CVSS 8.8 — SysReptor: Authenticated RCE by insecure image processingSysReptor is a fully...

  • CVE-2026-81179 — Syslifters sysreptor — CVSS 8.1 — SysReptor: Host header injection might allow account takeoverSysReptor is a f...

📋 ADVISORIES

  • 📄 Source for Check Point patches critical flaw enabling root code execution on management servers — nvd.nist.gov

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check