Threat Intelligence Database

Sharp versions before 0.35.0 include a bundled libvips library with multiple vulnerabilities affecting GIF, TIFF, and VIPS image decoders. These vulnerabilities allow attackers to supply crafted image files to applications using sharp, potentially triggering the underlying libvips flaws. The issue is resolved in sharp 0.35.0 and later.

CVE-2026-114112 is a heap-based buffer overflow vulnerability in the sharp image processing library before version 0.35.4. It arises from a vulnerable bundled libheif dependency that processes AVIF/HEIF images. An attacker can supply crafted malicious images to trigger this flaw, potentially leading to remote code execution on glibc-based Linux systems.

Multiple vulnerabilities, including two rated as high severity under CVSSv4, were found and fixed in the libvips library used by sharp. Versions of sharp prior to 0.35.0 that process untrusted input are affected. The vulnerabilities have been addressed in libvips 8.18.3, which is included starting with sharp version 0.35.0. Users relying on prebuilt sharp binaries should upgrade to at least version 0.35.3. Those using a globally installed libvips must ensure it is updated to 8.18.3. As a workaround, sharp can be configured to block decoding of GIF, TIFF, and VIPS images to mitigate risk until patched. No known exploits are reported in the wild.