IRIS C2 makes a HEIC decoder compute the file's own SHA-256
The 512 MiB image sequence uses 564 HEVC pictures and Apple's stock ImageIO decoder; the company says it needs no decoder bug or custom playback code.
By Ryan Merket · Published
Primary source: IRIS C2
Why it matters
A standards-conforming image can encode a fixed computation for a stock decoder, underscoring why security reviews and media-scanning pipelines must account for sequence frames and total decode work, not just parser bugs or poster images.
IRIS C2 published a 536,870,946-byte HEIC image sequence that it says makes Apple's unmodified ImageIO decoder compute and display the file's own SHA-256 digest. The final of 564 pictures spells the same 64-character value produced by hashing the file bytes, according to the company's technical write-up, posted September 23rd.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.