flawopen.com/Incidents/openai-community-forum-heif-sso-chain-september-2026
OpenAI Forum-to-SSO Chain: CVE-2026-32882
Hacktron reported chaining a libheif alpha-plane over-read in Discourse’s image path with a separate OpenAI SSO flaw. CVE-2026-32882 is fixed upstream in libheif 1.22.0; the researchers say they stopped after a harmless proof-of-access pull request.[4], [1], [2]
Imagine two transparent sheets: one has a wide row of color squares, while the other has a narrower row of transparency values. The decoder used the wide sheet’s row length to find the next transparency value, so each row it read drifted farther beyond the smaller sheet. The fix uses the transparency sheet’s own row length.[1]
Core Concepts & Subsystem Terms
HEIF / HEIC- An image container format. A HEIF file can contain derived images, overlays, and separate color and alpha planes that a decoder must keep within their own bounds.[1]
libheif- The native library that decodes and encodes HEIF and AVIF images. Discourse’s advisory connects its image-upload processing path to
CVE-2026-32882.[1], [2] Stride- The number of bytes between the start of one image-plane row and the next. Different bit depths can give the color and alpha planes different strides.[1]
CWE-125- Out-of-bounds read: software reads beyond the memory region allocated for a buffer. Here the alpha-plane address was advanced using the color-plane stride.[1]
SSO trust boundary- The identity relationship between a sign-in service and an application. Hacktron reported that the OpenAI forum’s SSO relationship widened the impact of the separate forum compromise; the public report does not disclose the exact SSO implementation flaw or patch.[4]
Framework mappings
- CWE reference for the weakness described in this guide: CWE-125
Incident Timeline
The libheif maintainer publishes GHSA-hg7q-rjr2-8x46, identifies CVE-2026-32882, and lists libheif 1.22.0 as fixed.[1]
Hacktron says its researchers reached the OpenAI community forum through the Discourse image path, reported the OpenAI-side SSO issue, and stopped testing after a harmless proof-of-access pull request.[4]
Discourse publishes GHSA-vhm9-85gw-x335, lists patched Discourse releases, and recommends rebuilding self-hosted installations.[2]
Hacktron publishes its account of the coordinated disclosure. The report says OpenAI confirmed its SSO-side fix and clarifies that the bounty recognized that OpenAI-side finding, not testing against Discourse’s hosted forum.[4]
Step-by-Step Attack Flow
Color-plane layout is reused for alpha
In HeifPixelImage::overlay(), the vulnerable code advances alpha_p by y * in_stride even though alpha_stride was obtained for that plane. When alpha and color bit depths differ, the row sizes differ and the read can pass the alpha allocation. The upstream advisory classifies this as CWE-125.[1]
The downstream impact depends on the host path
The libheif advisory describes a crash or potential disclosure through decoded pixels. The separate Discourse advisory describes remote code execution through its upload path and rates the Discourse issue CVSS 8.8. Do not substitute that product-level rating or impact for the CVE’s own CVSS 7.1 and read classification.[1], [2]
A separate SSO weakness widened the reported chain
Hacktron says the forum compromise enabled access to employee ChatGPT/Codex accounts through an OpenAI SSO issue and that a harmless pull request demonstrated connected repository access. The public evidence does not expose the SSO code defect, exact account permissions, or a reusable SSO fix.[4]
Keep the proof and the claims bounded
Hacktron says it stopped testing after the proof-of-access pull request. Its report describes a controlled researcher disclosure, not a malicious incident or evidence that customer data was taken. The researchers also state that OpenAI’s bounty award covered its SSO finding and excluded testing the Discourse-hosted forum.[4]
Source Code: Flaw vs. Secure Implementation
This is a focused excerpt, not a standalone decoder or a verbatim full patch. The maintainer’s advisory identifies the vulnerable expression and says the issue is fixed in libheif 1.22.0. Each plane must be indexed with its own stride; reusing the color stride makes the alpha read advance too far when the planes have different bit depths. In a host application, also keep image decoders patched and isolate conversion of untrusted uploads.[1], [3]
// Simplified excerpt of the documented access pattern.
// alpha_stride was available, but the color stride was used.
uint8_t alpha_value = alpha_p[in_x0 + y * in_stride + x];// Use the row layout belonging to the alpha plane.
// The upstream fix is in libheif 1.22.0.
uint8_t alpha_value = alpha_p[in_x0 + y * alpha_stride + x];Engineering & System Hardening Checklist
- ✓For self-hosted Discourse, update to a patched release listed in GHSA-vhm9-85gw-x335 and rebuild the application image; a web-interface-only update does not establish that the native libheif package changed.[2], [4]
- ✓Inventory the libheif version actually present in every image-processing container and verify the distribution’s backport status; upstream version strings alone can misstate a distribution package’s patch state.[6], [4]
- ✓When indexing an image plane, use that plane’s stride and dimensions. Add regression coverage where alpha and color planes have different bit depths and row strides.[1], [3]
- ✓Run HEIF/AVIF conversion for untrusted uploads in a constrained, disposable worker with minimal filesystem access, no ambient credentials, and bounded CPU and memory.[2]
- ✓Review SSO trust relationships separately from the parser fix: validate issuer, audience, redirect URI, account linking, and session binding, then revoke sessions if the identity boundary may have been crossed.[4]
- ✓Do not describe the OpenAI SSO implementation or its exact patch as known from this disclosure; the public report gives the researcher’s account but not the code-level defect or fix.[4]