CVE-2026-114112

Received Received - Intake

Remote Code Execution in Sharp via libheif Vulnerability

Publication date: 2026-10-21

Last updated on: 2026-10-22

Assigner: VulnCheck

Description

Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-22

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114112

EUVD

EUVD-2026-106915

Affected Vendors & Products

Vendor	Product	Version / Range
lovell	sharp	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability affects Sharp versions before 0.35.4 due to a bundled outdated libheif library used for AVIF/HEIF image decoding. Attackers can exploit a heap-based buffer overflow in libheif by providing malicious AVIF or HEIF images to applications using Sharp, leading to arbitrary code execution on glibc-based Linux systems.

Detection Guidance

Check the installed version of Sharp using 'npm list sharp' or 'npm list -g sharp'. If it shows a version prior to 0.35.4, the system is vulnerable. Inspect the libheif version linked to Sharp by running 'ldd $(which sharp) | grep libheif' to verify if it uses a vulnerable version.

Impact Analysis

If you use Sharp to process untrusted images, attackers could execute arbitrary code on your system by submitting crafted AVIF or HEIF files. This could lead to data breaches, system compromise, or unauthorized access, especially if the application runs with elevated privileges.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Upgrade Sharp to version 0.35.4 or later using 'npm install sharp@latest'. Alternatively, ensure a globally installed libheif version of 1.23.2 or higher. As a temporary workaround, block AVIF image decoding in Sharp or use a PIE-compiled Node.js binary.

Hi! I’m here to help you understand CVE-2026-114112. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...