CVE-2026-114112High· 8.9▾ TwilightSharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 49 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.
sharp < 0.35.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
GHSA-rgj7-g3m4-5g8cHighsharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545
CVE-2026-114111High· 8.9Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability
CVE-2026-114113High· 8.4Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders
CVE-2026-61825High· 8.7code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces
CVE-2026-61823High· 7.3code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces
GHSA-wq5f-xc86-pv6wHighsharp : Vulnerability in librsvg dependency CVE-2026-96889