Perhaps this is the exploit chain (they mention libheif at the start of their exploit chain)

  https://www.hacktron.ai/blog/hacking-openai

  https://news.ycombinator.com/item?id=49749656