Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers

This post details the discovery, reproduction, and mitigation of a remote code execution (RCE) vulnerability in libheif, an AVIF image decoder used by Next.js image optimization. It outlines the dependency chain from Next.js's `<Image>` component through sharp and libvips to libheif. Vercel implemented a platform-wide mitigation by disabling AVIF optimization in its Image Optimization Service. The post also describes the coordination with Hacktron and upstream maintainers of sharp, libvips, and libheif for a fix, and the subsequent security release by Next.js that disabled AVIF optimization as a timely mitigation.