CVE-2026-114112

UNKNOWN 0.0

Sharp before 0.35.4 RCE via bundled libheif AVIF decoding

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.

CWE	CWE-122
Vendor	lovell
Product	sharp
Published	Oct 21, 2026

Stay Ahead of the Next One

Get instant alerts for lovell sharp

Be the first to know when new unknown vulnerabilities affecting lovell sharp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

lovell / sharp

0 < 0.35.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c vulncheck.com: https://www.vulncheck.com/advisories/sharp-before-0.35.4-rce-via-bundled-libheif-avif-decoding