GHSA-vhm9-85gw-x335: RCE via malformed HEIF file

  • The advisory ID is GHSA-vhm9-85gw-x335.
  • Its title is RCE via malformed HEIF file.
  • The publisher is davidtaylorhq, in the discourse/discourse repository.
  • It was published on 28 July 2026.
  • Severity is High, with a CVSS score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
  • The advisory text references upstream libheif CVE-2026-32882.
  • The advisory credits hacktronai-research as the reporter.

Patched in 2026.7.0, 2026.6.1, 2026.5.2 and 2026.1.6

Advisory lists affected version trains including >= 0 and dated *-latest lines (2026.6.0-latest, 2026.5.0-latest, 2026.1.0-latest among those shown on the advisory page).

The advisory lists patched versions 2026.7.0, 2026.6.1, 2026.5.2 and 2026.1.6.

Upstream libheif flaw reached through image uploads

An upstream vulnerability in libheif allows remote code execution via Discourse image uploads. The latest Discourse Docker image includes the patched libheif. Update as normal via ./launcher rebuild app. Latest supported Discourse core versions also add sandboxing for image processing as defense in depth where the kernel supports it.

Rebuild the container image

From the advisory and Hacktron's aligned patch notice for self-hosters:

  • Rebuild the container image. A web-UI-only update may not replace the underlying decoder package.
  • Discourse-hosted customers were already patched per the advisory text.

Hacktron's Hacking OpenAI chain

Hacktron's "Hacking OpenAI" places this advisory inside a longer chain that also involved an OpenAI SSO issue. The GHSA itself addresses the Discourse upload path into libheif. It does not document OpenAI SSO.

Do not treat the GHSA as a PoC

Use this article for patch status and rebuild instructions. Use the Hacktron post for identity-boundary narrative. Do not treat the GHSA as a PoC.