IRIS C2 makes a HEIC decoder compute the file's own SHA-256

Why it matters

A standards-conforming image can encode a fixed computation for a stock decoder, underscoring why security reviews and media-scanning pipelines must account for sequence frames and total decode work, not just parser bugs or poster images.

IRIS C2 published a 536,870,946-byte HEIC image sequence that it says makes Apple's unmodified ImageIO decoder compute and display the file's own SHA-256 digest. The final of 564 pictures spells the same 64-character value produced by hashing the file bytes, according to the company's technical write-up, posted September 23rd.

The construction turns ordinary HEVC decoding into a finite processor for one fixed task. Prediction modes move sample values; residuals provide corrections; motion vectors copy data between pictures; and the decoder's ordered reconstruction determines when each operation runs. IRIS C2 says the sequence performs SHA-256's message schedule and all 64 compression rounds, then converts the result to hexadecimal pixels. A custom compiler writes the file, while stock Apple ImageIO handles playback.

That distinction defines the security significance. IRIS C2 says the file uses standards-conforming decoder behavior and does not exploit a memory-corruption flaw, escape a sandbox or execute native code. It is a demonstration of computation encoded in a media format, not a working decoder exploit. The company, which describes its business as offensive cyber tools and vulnerability research for government customers, is using the experiment to probe how much logic can be assembled from operations that a decoder already performs.

The result extends a line of work IRIS C2 began with a September 5th JPEG XL demonstration, which used that format's branching logic and channel structure to calculate a hashquine. The HEIC implementation changes the machine's substrate: it distributes work across an image sequence, using inter-picture motion compensation as a data bus. IRIS C2 says that moving information between pictures was essential because the decoder's within-picture sample order restricts how values can travel.

The artifact's size is part of the result, and part of its practical limit. At roughly 512 MiB, the file contains 564 pictures, each 16,384 by 6,976 luma samples. IRIS C2 estimates that decoding the full sequence entails about 64 billion sample values. Its write-up says Apple's ImageIO reports all the pictures, while some photo-library interfaces select picture 0 as the preview; the digest appears only in picture 563. A thumbnailer or scanning tool that inspects only the poster frame would therefore see a mostly gray computation surface rather than the final hash display.

IRIS C2 reports checking the exact file hash against the final decoded image and says its verifier found all 64 glyphs with no cell mismatches. The digest is 802cc6d654ad15aafbb1ca5db4824292cc39fd72cf23fd80e1230d90679b9ff1. That self-reference is engineered rather than discovered through a brute-force search: the file's physical byte order is arranged so its final bytes can encode the SHA-256 state needed to finish the digest, while the HEIF sample table presents pictures to the decoder in a different logical order.

There is a precedent for treating image decoders as more than passive renderers. Google's Project Zero analysis of FORCEDENTRY described an NSO Group iMessage exploit that used JBIG2 image operations to build a small computer after a memory-corruption bug enabled access to memory outside the image buffer. IRIS C2's HEIC artifact lacks that exploit step. The comparison is about the computational potential of format operations; it does not make this file equivalent to FORCEDENTRY.

The narrower operational takeaway is that image handling involves more than parsing a single still image. This sequence uses HEIF's image-sequence and inter-prediction paths, and its displayed output varies depending on which frame a tool decodes. Those details matter for systems that inspect, transform or index uploaded media. They do not establish that a decoder vulnerability exists, or that the hashquine can access data beyond its own encoded computation.

IRIS C2 says it is releasing the artifact, compiler and verification tools alongside the report. The experiment's strongest result is also its boundary: a large, deliberately constructed file can make a stock decoder carry out a particular cryptographic circuit, but the file cannot choose arbitrary work or acquire authority the decoder does not already have.