Preliminary research

WordPress libheif RCE

Adrian Tiron · Fortbridge · 5 October 2026

AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Extends earlier libheif research with a WordPress chain that recovers live addresses from returned JPEG pixels, selects exact native builds and reserves a PHP-FPM worker before hijacking C++ dispatch. Requires an upload-capable account and one of two measured stacks.

Record

Researcher

Adrian Tiron

Published by

Fortbridge

Date

5 October 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• PoC and exact lab profiles
• Original overflow disclosure
• Original disclosure primitives

Tags

• wordpress
• memory-corruption
• heap-overflow
• aslr
• image-processing
• exploit-development

This page is the archive's own catalogue record. The research is the work of Adrian Tiron, first published at the original source. Preserved copies are kept so the citation survives its host.