"HEIF Heist is Hacktron's name for a class of remote attack paths targeting services that decode attacker-controlled HEIF, HEIC, or AVIF images"

https://heif-heist.com/

Cool finding, but these issues have been around for ages. It's embarrassing for all the affected large corps that they didn't care to invest in testing their dependencies and proper sandboxing.