From a Single Image to OpenAI Monorepo: How a libheif Heap Overflow and SSO Flaw Chained to PR #1186742

TL;DR

Security research team Hacktron AI disclosed on September 18, 2026, how they chained an image decoder flaw in Discourse with an OpenAI Single Sign-On (SSO) configuration issue to reach OpenAI’s internal monorepo through compromised employee credentials.
The responsible disclosure exercise took place on July 25, 2026, taking less than 72 hours from initial discovery to repository access.

The incident was not a single critical bug, but a multi-stage exploit chain.
A memory corruption vulnerability in an external help forum cascaded through central authentication infrastructure, reaching the company’s internal GitHub development environment.

The exploit chain: From HEIF upload to internal PR

The full attack flow is illustrated below:

flowchart TD
  A["Upload HEIC/HEIF image to community.openai.com"] --> B["Discourse falls back to ImageMagick<br/>magick command due to FastImage limitation"]
  B --> C["libheif decodes HEIC image<br/>Heap buffer overflow triggered"]
  C --> D["ASLR bypassed on forum server<br/>Remote Code Execution (RCE) achieved"]
  D --> E["Exploit OpenAI SSO identity flaw<br/>Hijack active forum user sessions"]
  E --> F["Take over OpenAI employee ChatGPT / Codex accounts"]
  F --> G["Access internal GitHub organization via employee Codex integration"]
  G --> H["Open PR #1186742 in internal monorepo openai/openai"]

Each stage of the chain served a distinct role:

Stage	Target Component	Action Taken	Gained Capability
1. Entry	community.openai.com (Discourse)	HEIF image upload	Execution of image conversion pipeline
2. Vulnerability 1	libheif 1.19.7 (Debian 12)	Heap buffer overflow	Out-of-bounds read/write (OOB R/W) primitive
3. Code Execution	Forum container	Shell payload generated with Claude Opus 5	Remote code execution and container admin
4. Vulnerability 2	auth.openai.com (OpenAI SSO)	SSO identity handling flaw	Hijacking sessions of logged-in forum users
5. Lateral Movement	Employee ChatGPT / Codex	Account takeover	Access to connected internal GitHub organization
6. Impact Proof	Internal monorepo openai/openai	Prompted Codex to commit and open PR	Proved write capability in internal codebase

While the initial entry was an unauthenticated help forum, the endpoint was an employee’s personal development environment and internal codebase.

The silent patch trap in libheif

The attack vector originated in Discourse’s image upload handling.
Discourse typically checks image dimensions and headers using FastImage.
However, because FastImage does not support HEIC or HEIF files, Discourse passed those files to ImageMagick’s magick command for conversion.

This fallback routed untrusted user input directly into libheif, a C/C++ image parsing library.
We previously examined a similar pattern in Rails CVE-2026-66066, where Active Storage fell back to libvips and exposed server credentials.
Even when the web application framework itself is hardened, handing parsing off to deep native media libraries sharply broadens the attack surface.

Compounding the risk was how libheif handled the bug fix.
Upstream had fixed the underlying issue a year earlier with commit 85e21ad44 (“simplify overlay overlap area computation”).
However, the commit was treated as standard code maintenance, lacked any security advisory, and received no CVE identifier.

Because vulnerability databases never logged the issue, the Debian project had no trigger to backport the patch.
Discourse’s Docker image ran Debian 12, leaving the vulnerable libheif 1.19.7 active in production.
As explored in SQLite’s fake CVE controversy and unreviewed advisory databases, software ecosystems frequently struggle with CVE noise while critical memory safety fixes remain hidden in undocumented commits, never reaching downstream distributions.

Overcoming ASLR in three hours with Claude Opus 5

Turning a heap corruption bug into a reliable remote shell in production is notoriously difficult.
Discourse’s target environment enforced ASLR (Address Space Layout Randomization) and utilized jemalloc, preventing naive memory overwrites.

Hacktron AI used Anthropic’s Claude models to assist in the vulnerability analysis and exploit development.
The researchers set up target Docker containers, defined exploitation constraints, and orchestrated the iteration loops.
With Claude Opus 4.8, the team managed to obtain a working exploit on a local container with ASLR disabled, but hit a wall trying to bypass ASLR in the default environment.

The breakthrough came with the release of Claude Opus 5 later that evening.
Feeding the exact same challenge to Opus 5, the model produced a functional ARM64 exploit within 3 hours.
The team then asked the model to port the payload to x86-64 and Discourse’s specific jemalloc heap layout.
By 6:00 a.m. UTC on July 25, 2026, the team confirmed local RCE via an image upload.

To test the remote attack, the team placed Claude in an autonomous /goal loop.
Because frontier models include safeguards against attacking live remote servers, the researchers routed traffic through a CTF-styled proxy (rce.ee/ctf-forum).
By 10:00 a.m. UTC, the agent successfully executed code on the remote Discourse instance and read /etc/hosts.

In our earlier coverage of WordPress 7.0.3 and XSS2Shell, pwn.ai deployed multi-agent workflows to chain DOM clobbering into admin account takeovers.
AI security agents have clearly moved beyond isolated code audits: they are now capable of assembling end-to-end exploit chains against real-world mitigations in hours.

How OpenAI SSO linked a forum to employee accounts

Under standard network segregation, compromising a public forum should not jeopardize internal core infrastructure.
Discourse is an external-facing community tool, isolated from OpenAI’s private development networks.

The link was created by Single Sign-On (SSO).
The forum provided a “Sign in with OpenAI” button routed through auth.openai.com.
Because Hacktron AI held administrative RCE over the forum server, they could intercept token exchange mechanisms during user logins.
An identity misconfiguration on OpenAI’s SSO side allowed attackers to translate control over the forum service into hijacked sessions for users’ ChatGPT and Codex accounts.

Crucially, this was not a Discourse bug.
OpenAI’s SSO identity architecture failed to maintain zero-trust isolation against compromised integration partners.
Had any other first-party or third-party tool connected to OpenAI SSO been breached, the exact same account takeover path would have opened.

Proving impact via PR #1186742 and a 14-hour turnaround

With employee credentials in hand, the team faced the ethical challenge of proving full impact without exfiltrating sensitive intellectual property.
One of the compromised accounts belonged to an active OpenAI engineer whose Codex tool was integrated with OpenAI’s internal GitHub organization.

Rather than cloning internal code or inspecting repositories, the researchers sent a prompt to the employee’s Codex interface, instructing it to open a pull request (PR #1186742) in the internal monorepo openai/openai.
By generating a benign change and opening a PR from inside the corporate boundary, the team definitively demonstrated unauthorized write access to core infrastructure without accessing private data.

The coordinated response proceeded rapidly:

Date & Time (UTC)	Party	Milestone
July 25, 2026 05:00–06:00	Hacktron AI	Achieved initial RCE on forum container
July 25, 2026 08:00–10:00	Hacktron AI	Submitted vulnerability report via OpenAI Bugcrowd
July 25, 2026 13:30–15:30	Hacktron AI	Opened PR #1186742 via employee Codex; alerted OpenAI and stopped testing
July 25, 2026 22:49	OpenAI	Confirmed server-side SSO fix deployed (~14 hours after report)
July 25, 2026	Hacktron AI	Submitted report to Discourse via HackerOne
July 27, 2026	Discourse	Prepared fix including ImageMagick sandboxing
July 28, 2026	Discourse	Published security advisory GHSA-vhm9-85gw-x335
August 8, 2026	Debian	Released DSA-6417-1 patching libheif in Debian 13
September 1, 2026	OpenAI	Awarded $6,500 bounty recognizing the SSO finding
September 18, 2026	Hacktron AI	Public technical write-up published

OpenAI deployed a fix for the SSO issue within roughly 14 hours of the report.
While attacks against Discourse were out of scope for OpenAI’s bug bounty program, OpenAI awarded a $6,500 bounty in recognition of the critical SSO finding.

Discourse also responded swiftly over the weekend, delivering a fix on Monday.
Rather than relying solely on upstream package updates, Discourse introduced process sandboxing for ImageMagick, ensuring that future parser bugs cannot compromise the host environment.

Hacktron AI has since expanded this research into “HEIF Heist,” analyzing libheif dependencies across major platforms including Slack, Zoom, Meta, Ruby on Rails, Next.js, and Astro.
As media parsers continue to exhibit memory safety vulnerabilities, strict process isolation and least-privilege identity federation remain essential defenses.