Reproducing, disclosing, and fixing the libheif vulnerability

In August 2026, security researchers at Hacktron reported what initially appeared to be a remote code execution vulnerability inside Next.js image optimization. A coordinated investigation involving Hacktron, Vercel, and the libheif maintainers traced the vulnerable code not to Next.js itself but to libheif, an upstream AVIF image decoder that Next.js depends on — and that is also used by ImageMagick, WordPress, and a range of other widely deployed software.

This article walks through the mechanics of the flaw, explains which systems and developers are at risk, and outlines the immediate remediation steps available while some details remain publicly undisclosed. It is aimed at developers, security engineers, and platform operators running image-processing pipelines that touch AVIF or HEIC files.

What broke in Reproducing

Hacktron's initial report targeted Next.js image optimization, but the root cause landed in libheif, the C library responsible for decoding AVIF and HEIC image formats. Because libheif is a shared dependency, the vulnerability existed in every application and platform that uses the library to process those image types — not just Next.js. The disclosure process required coordinating across multiple maintainer teams simultaneously, since a fix in Next.js alone would have been insufficient and potentially misleading to the broader ecosystem.

The flaw was serious enough to carry a remote code execution classification at the point of initial report. RCE vulnerabilities in image decoders are particularly dangerous because image processing is often treated as a low-trust, routine operation, making it easier for attackers to reach the vulnerable code path without raising alerts.

Who is exposed by Reproducing

Any application that accepts and processes AVIF or HEIC images through a pipeline that includes libheif is potentially affected. That scope extends well beyond Next.js: ImageMagick, which is embedded in countless image-handling scripts and server-side workflows, also depends on libheif. WordPress introduced automatic HEIC-to-JPEG conversion in its core, meaning self-hosted WordPress installations processing user-uploaded images could be in scope.

The exposure is widest for services that accept untrusted image uploads from the public — social platforms, media tools, content management systems, and any SaaS product with user-generated media. Developers running Next.js with image optimization enabled are affected where the underlying Node image processing layer pulls in a vulnerable libheif build. Managed platforms that pin or vendor their own native dependencies may have a different exposure surface depending on which libheif version they ship.

What to do now about Reproducing

The first priority is to identify whether libheif is present in the dependency tree, either directly or through an intermediate library such as ImageMagick or a native Node image binding. Package managers and dependency audit tools can surface this, though native C library transitive dependencies do not always appear in standard lock files and may require inspecting build environments or container images.

Once the affected version is confirmed, upgrade libheif to the patched release issued by the maintainers as part of this coordinated disclosure. For Next.js deployments specifically, check whether Vercel has shipped an updated image optimization layer and apply that update. For WordPress installations, monitor the WordPress core team for a corresponding security release. If an immediate upgrade is not possible, temporarily disabling AVIF and HEIC upload acceptance or processing is a viable short-term mitigation while a proper patch is staged.

How the Reproducing issue works

The RCE classification indicates the vulnerability allows an attacker to influence execution flow, not just crash the process. This can happen through techniques like heap corruption, type confusion, or out-of-bounds writes that overwrite function pointers or return addresses. Because image processing pipelines often run as part of web request handling — synchronously or in worker processes — successful exploitation of this path could give an attacker code execution within the server environment processing the image.

What is still unknown about Reproducing

The specific CVE identifier, CVSS score, and precise technical details of the vulnerable code path have not been made fully public as of this disclosure. The coordinated nature of the release — spanning Hacktron, Vercel, the libheif maintainers, and the WordPress core team — suggests information was sequenced deliberately to give downstream consumers time to patch before a full technical writeup appears.

It is also not yet clear whether the vulnerability has been observed being exploited in the wild, or whether a proof-of-concept exploit is circulating privately. The exact libheif version range that is affected has not been confirmed in publicly available documentation at this stage. Developers should treat any libheif version predating the patched release as suspect and prioritize the upgrade accordingly, checking back with the libheif and Vercel security advisories as the full disclosure timeline completes.