---
id: 10349
title: "Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers"
source_domain: vercel.com
source_url: "https://vercel.com/blog/reproducing-disclosing-and-fixing-the-libheif-vulnerability-with-hacktron-and-the-maintainers"
published_at: "2026-09-18T00:00:00Z"
tags: ["rce", "cloud-security", "vulnerability-research", "web-security", "vercel"]
phying_url: "https://phying.com/item/10349"
lang: en
---

# Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers

## Summary

How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.

## Intelligence Metadata

- **Sources:** vercel.com
- **Published:** 2026-09-18T00:00:00Z
- **Original:** https://vercel.com/blog/reproducing-disclosing-and-fixing-the-libheif-vulnerability-with-hacktron-and-the-maintainers
- **Phying News:** https://phying.com/item/10349