A heap overflow and SSO misconfiguration to compromise OpenAI internal repos

A heap overflow vulnerability in libheif, versions 1.19.7 and 1.19.8, affected Debian 12 and 13, which were used in Discourse’s Docker image. This vulnerability, part of the "HEIF Heist" ecosystem, was not documented as a security fix upstream, leading to delayed backports. Debian 13 received its security update on August 8, 2026. Any deployment without the latest upstream security patches for libheif versions like 1.19.x, 1.20.x, 1.22.x, and 1.23.x remains potentially vulnerable.