High severityNVD Advisory· Published Oct 21, 2026

CVE-2026-114112

Description

Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Lovell/sharpllm-fuzzy
Range: <0.35.4

Patches

Vulnerability mechanics

References

github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8cnvd
www.vulncheck.com/advisories/sharp-before-0.35.4-rce-via-bundled-libheif-avif-decodingnvd

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000