CVE-2026-114112 PUBLISHED

Sharp before 0.35.4 RCE via bundled libheif AVIF decoding

Assigner: VulnCheck
Reserved: 20.10.2026 Published: 21.10.2026 Updated: 21.10.2026

Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 8.9

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Local	Confidentiality	High	Confidentiality	High
Attack Complexity	Low	Integrity	High	Integrity	High
Attack Requirements	Present	Availability	High	Availability	High
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	lovell
Product	sharp
Versions	Default: unaffected affected from 0 to 0.35.4 (excl.) Version 0.35.4 is unaffected

References

Problem Types

Heap-based Buffer Overflow CWE