CVE-2026-114112 Sharp before 0.35.4 RCE via bundled libheif AVIF decoding
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114112?
CVE-2026-114112 is a high-severity vulnerability in lovell sharp, published on 21 Oct 2026.
Official description
Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.
Weakness: CWE-122
Which versions are affected by CVE-2026-114112?
2 open source packages ship an affected version, including sharp.
| Package | Affected | Fixed in |
|---|---|---|
sharp npm | All versions | 0.35.4 |
sharp npm | All versions | 0.35.4 |
How do I fix CVE-2026-114112?
Upgrade sharp to 0.35.4 or later.
Is CVE-2026-114112 being exploited?
There is no known exploitation of CVE-2026-114112 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-SX69488, CLEANSTART-2026-UG53447, ECHO-2762-76fb-9bb0, GHSA-gqw3-74gm-648q, GHSA-rgj7-g3m4-5g8c, MINI-53hj-pj4j-3x3h and 6 more.