libheif-grid-nextjs-rce

libheif grid-to-GOT Next.js RCE Working proof of concept that turns CVE-2026-32740 in the hardcoded Next.js/sharp image stack into a chosen-address write and a validated /usr/bin/id callback. This is a private Fortbridge research repository. Use it only against the included lab or another system...

CVE-2026-114112

Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif...

EUVD-2026-106915

Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif...

CVE-2026-114112 Sharp before 0.35.4 RCE via bundled libheif AVIF decoding

Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif...

CVE-2026-114112

The Sharp image processing library (versions prior to 0.35.4 ) is vulnerable to Remote Code Execution (RCE) on glibc-based Linux systems. The root cause is a heap-based buffer overflow (CWE-122) within a bundled libheif dependency. Attackers can exploit this by providing crafted AVIF or HEIF imag...

CVE-2026-114112

Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif...

CVE-2026-114112 Sharp before 0.35.4 RCE via bundled libheif AVIF decoding

Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif...

PT-2026-120238

Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif...

JPEG XL vs AVIF for web use-cases

JPEG XL has now landed in all major browsers, so I figured I'd take a closer look at what it's good/bad at compared to other formats. Conclusions I'll go into full detail, with examples and benchmarks, but for those of you who don't have the time, here are the headlines: For lossy photos on the...

[SECURITY] Fedora 43 Update: libheif-1.23.5-3.fc43

libheif is an ISO/IEC 23008-12:2017 HEIF and AVIF AV1 Image File Format file format decoder and encoder...

[SECURITY] Fedora 44 Update: libheif-1.23.5-3.fc44

libheif is an ISO/IEC 23008-12:2017 HEIF and AVIF AV1 Image File Format file format decoder and encoder...

[SECURITY] Fedora 45 Update: libheif-1.23.5-3.fc45

libheif is an ISO/IEC 23008-12:2017 HEIF and AVIF AV1 Image File Format file format decoder and encoder...

CVE-2026-84450

A flaw was found in libheif. A remote attacker could provide a specially crafted image file that, when processed by the libheif library, can lead to an integer overflow during crop calculations. This issue can cause assert-enabled builds to abort, resulting in a denial of service DoS. In release...

CVE-2026-84447

A flaw was found in libheif, a software library for decoding and encoding HEIF and AVIF image files. A remote attacker could exploit this by providing a specially crafted image file. This crafted file could cause the library to repeatedly process the same image data, leading to excessive use of t...

CVE-2026-84446

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker could provide a crafted HEIF file containing malicious sequence timing and edit-list data. This could lead to non-terminating decode loops and unbounded memory allocation, resulting in severe CPU and...

CVE-2026-84384

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker could exploit this vulnerability by providing a crafted HEIF or AVIF file containing malicious metadata or image data. This could cause the application to consume an unbounded amount of memory during...

DEBIAN-CVE-2026-84446

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::initsampletimingtable compute a logical mnumoutputsamples value that exceeds the uint32t counters used by TrackVisual::decodenextimagesample and...

UBUNTU-CVE-2026-84447

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processedids is copied per branch and ImageItem::decodeimage has no shared operation budget. This vulnerability is fix...

UBUNTU-CVE-2026-84444

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITHUNCOMPRESSEDCODEC is enabled, heifcontextaddimagetile accepts an independently constructed tile whose component-plane dimensions do not match the tile geometry established by the prototype image...

CVE-2026-84384 libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompressbrotli and doinflate to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no outpu...