Sharp before 0.35.4 RCE via bundled libheif AVIF decoding

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-114112 · Microsoft / collected KEV context

EUVD-2026-106915

GHSA-gqw3-74gm-648q

GHSA-rgj7-g3m4-5g8c

cve-program · CVE-2026-114112

• https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c
• https://www.vulncheck.com/advisories/sharp-before-0.35.4-rce-via-bundled-libheif-avif-decoding

euvd · EUVD-2026-106915

• https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c
• https://www.vulncheck.com/advisories/sharp-before-0.35.4-rce-via-bundled-libheif-avif-decoding

nvd · CVE-2026-114112

• https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c
• https://www.vulncheck.com/advisories/sharp-before-0.35.4-rce-via-bundled-libheif-avif-decoding

osv · GHSA-rgj7-g3m4-5g8c

• https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c
• https://github.com/strukturag/libheif/security/advisories/GHSA-2jg2-4ch7-h545
• https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497
• https://github.com/lovell/sharp
• https://github.com/lovell/sharp/releases/tag/v0.35.4

No related operational record is retained in the current change model.