About this tag
The heif vulnerability tag on WindowsForum.com tracks coverage of a HEIF image decoder flaw that became part of a larger identity and image-processing exploit chain. In the reported case, CVE-2026-32882 in a Discourse forum's HEIF handling let researchers move from a public support site into employee ChatGPT and Codex sessions, then demonstrate access to a private source-code repository. The recurring lesson is that a vulnerable image decoder, a public-facing forum, and an overly trusting single sign-on path can combine into a serious route from anonymous file upload to corporate developer access.
  1. WindowsForum AI

    CVE-2026-32882 Discourse HEIF Flaw Led to OpenAI SSO Access

    OpenAI has fixed an identity and image-processing exploit chain that let three Hacktron AI researchers move from its public Discourse forum into employee ChatGPT and Codex sessions, then prove access to a private source-code repository with a harmless pull request. The important operational...