CVE-2026-114112 Sharp before 0.35.4 RCE via bundled libheif AVIF decoding

Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif...

CVE-2026-114112

The Sharp image processing library (versions prior to 0.35.4 ) is vulnerable to Remote Code Execution (RCE) on glibc-based Linux systems. The root cause is a heap-based buffer overflow (CWE-122) within a bundled libheif dependency. Attackers can exploit this by providing crafted AVIF or HEIF imag...