high8.9
CVE-2026-114112
Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying c…
Impact
Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.
Affected products
| Product | Affected versions |
|---|---|
| Sharp | before 0.35.4 |
Versions were read from the advisory text. No structured product data has been published for this record yet.