Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
libheif-cve-2026-84383-lab — Docker lab for validating CVE-2026-84383 in libheif through Discourse | Kitploit
Tools/GitHubGitHub/dinosn/libheif-cve-2026-84383-lab
Container SecurityVulnerability AnalysisExploitationWeb Application ExploitationSecurity VirtualizationLabs & Practice
GitHubdinosn/libheif-cve-2026-84383-lab

libheif-cve-2026-84383-lab

Docker lab for validating CVE-2026-84383 in libheif through Discourse

View Repository
1031 month agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-84383 marker-only Discourse lab

An isolated Docker lab for independently validating the security boundary of CVE-2026-84383 / GHSA-g89c-p67h-r497 in libheif 1.23.1 and the 1.23.2 fix through Discourse's real authenticated upload and ImageMagick conversion path.

Result and scope

The lab performs four HTTP checks:

  1. Two independent uploads to vulnerable libheif 1.23.1 must create a fresh /tmp/cve-2026-84383-rce-marker owned by uid 1000 (discourse).
  2. The identical file sent through libheif 1.23.2 must return HTTP 422 and create no marker.
  3. A benign 16-bit HEIF sent through 1.23.2 must return HTTP 200, convert to JPEG, and create no marker.

The file contains one fixed command:

/usr/bin/id > /tmp/cve-2026-84383-rce-marker

This is a deterministic, mitigation-relaxed proof, not a production-ready exploit. Only the ImageMagick child runs with ASLR disabled and the Discourse image's bundled jemalloc preloaded. The ordinary ASLR-enabled/glibc path was confirmed vulnerable to memory corruption but was not shown to execute code. See Technical boundary.

Safety boundary

  • Native Linux x86_64 Docker host required.
  • No host port is published. The Compose network is marked internal.
  • No SSH service, public key, external callback, reverse shell, or arbitrary command option is included.
  • The verifier creates a temporary API key only inside the container and deletes it on success, failure, or interruption.
  • Containers, volumes, staged inputs, responses, keys, and markers are removed automatically when the verifier exits.

Do not deploy these images or run the fixture against systems you do not own or have explicit authorization to test.

Requirements

  • Native Linux x86_64
  • Docker Engine with Compose v2
  • Approximately 8 GB RAM and 20 GB free disk
  • Network access to Docker Hub, GitHub release assets, and Debian package repositories during the first build

The first build and Discourse database migration can take 10–30 minutes.

Run the complete verification

git clone https://github.com/dinosn/libheif-cve-2026-84383-lab.git
cd libheif-cve-2026-84383-lab
export LAB_ACK=I_UNDERSTAND_THIS_IS_AN_ISOLATED_LAB
./scripts/verify.sh

Expected terminal gates:

[cve-2026-84383] vulnerable HTTP run 1 status=200
[cve-2026-84383] vulnerable HTTP run 2 status=200
[cve-2026-84383] patched exploit control status=422 marker=absent
[cve-2026-84383] patched benign control status=200 marker=absent extension=jpeg
[cve-2026-84383] PASS: all marker, patched, and benign HTTP gates passed
[cve-2026-84383] containers, volumes, temporary key, inputs, and marker removed

HTTP 200 alone is not the execution oracle. The verifier removes the marker before every request and then checks its content and uid. The successful exploit response is intentionally incomplete because the controlled ROP tail exits the converter after writing the marker.

Force an image rebuild with LAB_REBUILD=1 ./scripts/verify.sh.

Pinned identities

ComponentIdentity
Discourse basediscourse/discourse@sha256:709c40fed5ea6fc8d2945aff57fd9bd4b11629195d1bda03eb3ec55b92e3e44a
Vulnerable libheif source1.23.1, SHA-256 0de0327f60fcd47de90d5654c6fe152232738d60d84fe084ec3e0f35e03b166a
Patched libheif source1.23.2, SHA-256 8bd5d41d19dc84536d118b04774709f244df6104ef66d623dad5fa4650143405
Marker fixtureSHA-256 130c89eff9b8dae1765f22326eaf8222e95c7c8c8201203f01ad04c4aeb5ef5e
Benign fixtureSHA-256 dcffc5fb99c6a34b27ff1bc451ccf091c2854c7bcbf2c7fdc1445286c917c6a9

SHA256SUMS is checked before Docker is started. The Docker builds also reject unexpected upstream source archives and unexpected critical runtime binaries.

Remediation

Upgrade libheif to 1.23.2 or later. Keep converter sandboxing, ASLR, seccomp, least privilege, upload validation, and process isolation as defense in depth. The libheif 1.23.2 release describes the security fix.

Repository contents

Dockerfile                 vulnerable libheif 1.23.1 application image
Dockerfile.patched         causal 1.23.2 control
Dockerfile.noaslr          deterministic child-process wrapper
compose.yaml               internal-only Discourse, PostgreSQL, and Redis
compose.noaslr.yaml        isolated seccomp override for setarch(1)
fixtures/                  fixed marker-only and benign HEIF inputs
scripts/preflight.sh       architecture, network, and integrity gates
scripts/verify.sh          complete positive/control/cleanup workflow
docs/                      technical boundary and expected evidence

References

  • Official advisory
  • libheif 1.23.2 security release
Download Tool