{"id":"EUVD-2026-106915","enisaUuid":"851af55c-b330-314a-8677-5e0de517098d","description":"Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.","datePublished":"Oct 21, 2026, 12:37:11 AM","dateUpdated":"Oct 22, 2026, 3:34:52 PM","baseScore":8.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c\nhttps://www.vulncheck.com/advisories/sharp-before-0.35.4-rce-via-bundled-libheif-avif-decoding\n","aliases":"CVE-2026-114112\nGHSA-gqw3-74gm-648q\n","assigner":"VulnCheck","epss":0.24,"enisaIdProduct":[{"id":"ffb457b3-d16f-30d3-9f9d-186c497cb693","product":{"name":"sharp","vendor":{"name":"code16"}},"product_version":"0 \u003c0.35.4"}],"enisaIdVendor":[{"id":"e7a6a42a-e2ad-3c6d-9eac-a560297e8573","vendor":{"name":"lovell"}}],"enisaIdVulnerability":[{"id":"0840ad3d-b427-36d5-ab62-8b558c6d2fc9","vulnerability":{"id":"GHSA-gqw3-74gm-648q","description":"Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.","datePublished":"Oct 21, 2026, 3:32:27 AM","dateUpdated":"Oct 21, 2026, 3:32:27 AM","baseScore":0.0,"references":"https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114112\nhttps://www.vulncheck.com/advisories/sharp-before-0.35.4-rce-via-bundled-libheif-avif-decoding\n","enisa_id":"EUVD-2026-106915\n","aliases":"GHSA-gqw3-74gm-648q\nCVE-2026-114112\n","epss":0.0,"dataProcessed":"Nov 4, 2026, 7:03:17 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"70bba3cb-167a-3df6-8fc5-3ed53283496c","vulnerability":{"id":"CVE-2026-114112","description":"Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.","datePublished":"Oct 21, 2026, 12:37:11 AM","dateUpdated":"Oct 22, 2026, 3:34:52 PM","status":"PUBLISHED","baseScore":8.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c\nhttps://www.vulncheck.com/advisories/sharp-before-0.35.4-rce-via-bundled-libheif-avif-decoding\n","enisa_id":"EUVD-2026-106915\n","assigner":"VulnCheck","epss":0.24,"dataProcessed":"Nov 4, 2026, 7:14:08 AM","vulnerabilityProduct":[{"id":"faad8070-5502-3b75-9e52-b2b3b42b05b6","product":{"name":"sharp","vendor":{"name":"code16"}},"product_version":"0 \u003c0.35.4"}],"vulnerabilityVendor":[{"id":"f6cad96f-8229-3b42-ad4e-bef1c14aaa02","vendor":{"name":"lovell"}}]}}],"enisaIdAdvisory":[]}