Loading story…
Research published by Fortbridge describes CVE-2026-32740 as a heap-buffer overflow in libheif's HeifPixelImage::copy_image_to() while decoding crafted HEIF or AVIF grid images with 4:2:0 chroma planes. In a deliberately vulnerable Next.js upload application using Sharp—whose native image-processing stack includes libvips and libheif—the researchers report achieving remote code execution by leaking pixel data to bypass ASLR, corrupting a libheif plane-map structure for a constrained write primitive, and redirecting libvips' memcpy GOT entry to an internal GModule loader. The demonstrated payload was an attacker-supplied ELF shared object disguised as a JPEG, executed when loaded by the process.
The reported exploit succeeded in 20 of 20 fresh test processes on specified Ubuntu and Debian profiles, but the authors state that exploitation relies on exact native-library versions, allocator behavior, upload handling, and binary layout. A Reddit post amplified the claim but provided no independent validation, affected-version range, vendor advisory, or confirmation of exploitation in the wild. Organizations running Next.js services that accept untrusted HEIF or AVIF uploads through Sharp should identify bundled libheif versions, upgrade to libheif 1.22.0 or later and rebuild native dependencies where applicable, and isolate or disable HEIF/AVIF processing until their deployments are verified.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Researchers described CVE-2026-32740 as a heap-buffer overflow in libheif processing crafted HEIF/AVIF grid images. In a deliberately vulnerable Next.js lab using sharp, they reported chaining a pixel-memory disclosure and libheif plane-map corruption to hijack libvips' memcpy GOT entry, load an uploaded shared object, and achieve command execution under specific tested builds.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcefortbridge.co.uk
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Vercel issued out-of-cycle updates for two critical unauthenticated remote-code-execution flaws in Next.js: an AVIF/HEIC image-processing heap overflow and Windows-only path traversal, tracked as `CVE-2026-75604`. The image flaw is rooted in `libheif`, reached through Next.js's `sharp` and `libvips` image-optimization chain; malicious files with duplicate alpha channels of differing bit depths can trigger a controlled heap overflow. The issue, reported with a CVSS v4 score of 9.5, was confirmed against multiple production applications, and patched Next.js releases disable AVIF optimization while an upstream dependency fix propagates. `CVE-2026-75604` affects the incremental cache on Windows because route paths do not properly escape backslashes. Attackers can use percent-encoded backslashes to leave the cache directory, read files available to the server process, and write attacker-controlled cache content to selected paths; under susceptible Server Action patterns, this can be chained to RCE. Organizations running affected Windows deployments using the Pages Router or App Router without Cache Components should upgrade to **Next.js 15.5.24 or 16.3.3**; no configuration-only mitigation is available. Linux and macOS are not affected by the cache-path flaw.
Sep 4, 2026
Next.js released **v16.3.3** and **v15.5.24** to remediate two critical unauthenticated remote-code-execution vulnerabilities. One flaw can be triggered when the Image Optimization API processes an attacker-controlled AVIF image through the `sharp` dependency and its underlying `libheif` library; Next.js disabled AVIF optimization while awaiting propagation of an upstream `libheif` fix. The second vulnerability, **CVE-2026-75604**, affects Windows-hosted applications using both the Pages Router and App Router without Cache Components; Linux and macOS deployments are not affected, and no workaround is available. The Canadian Centre for Cyber Security advised organizations running Next.js 15.5 earlier than 15.5.24 or 16.3 earlier than 16.3.3 to review the security release and apply the updates.
Sep 2, 2026
FFmpeg patched **CVE-2026-8461**, a high-severity heap out-of-bounds write flaw dubbed **PixelSmash** in the `libavcodec` **MagicYUV** decoder. The bug is triggered by an odd `slice_height` condition while parsing malicious **AVI**, **MKV**, or **MOV** files and affects FFmpeg versions before **8.1.2**. The vulnerability can cause denial of service and, in some environments, lead to remote code execution. JFrog reported that applications embedding FFmpeg are exposed through their media-processing pipelines, and demonstrated full remote code execution against **Jellyfin 10.11.9** via its automated media library scan workflow, although successful RCE required **ASLR** to be disabled or bypassed. **Nextcloud** was also identified as potentially vulnerable under additional conditions, while **Plex** appears largely protected by a restricted custom FFmpeg build. Organizations using FFmpeg directly or through downstream products have been urged to upgrade to **FFmpeg 8.1.2 or later** and apply vendor patches because the decoder’s broad adoption creates a notable supply-chain exposure.
Jul 30, 2026