Canvas threat report

Canvas (Discourse) image upload functionality was vulnerable to remote code execution through malformed HEIF image files via the libheif dependency. The vulnerability involved integer overflow edge cases in the overlay composition function, with at least three distinct bugs (including CVE-2026-32882) exploited by the Hacktron threat group to compromise systems, including OpenAI's internal infrastructure. The exploit chain traced to a May 2025 fix in libheif that was not flagged as security-relevant and failed to reach stable Debian distributions Canvas deployments relied upon.

• Part 2: The Security of a Key Dependency, Funneled Through One M(opens in a new tab)