Junglewise Threat Intelligence

sharp heap-based buffer overflow via libheif image parsing

Severity: high · CVSS 8.9 · Published 2026-09-08

Executive brief

Sharp is a popular Node.js image processing library used to resize, crop, and transform images in web applications and services. Multiple critical vulnerabilities in its bundled libheif dependency can allow attackers to execute arbitrary code when processing untrusted HEIF or AVIF image files. This could lead to complete system compromise and data breach on affected servers.

Technical details

Sharp 0.35.4 addresses vulnerabilities discovered in the upstream libheif 1.23.1 dependency, comprising 11 separate issues stemming from incorrect assumptions about HeifPixelImage geometry and plane handling. The root cause involves derived items (iden and auxl chains) that allow attackers to construct images violating geometry invariants, causing out-of-bounds read/write operations and heap buffer overflows (CWE-122, CWE-787, CWE-125). Specific issues include heap buffer overflow in scale_nearest_neighbor() due to duplicate alpha planes and out-of-bounds operations in pixel-plane handling. Attack requires only an untrusted HEIF/AVIF file processed via heif_decode_image() with no special privileges or authentication. While libheif claims network attack vector, sharp itself provides no networking, so this is downrated to local attack vector in practice. Exploitation can achieve RCE on glibc-based Linux systems. Patch available: upgrade to sharp 0.35.4 (bundling libheif 1.23.2) or update libheif globally to 1.23.2.

Affected products

  • lovell sharp < 0.35.4
  • libheif <= 1.23.1

Timeline

  • 2026-08-25: disclosed: Vulnerabilities discovered in libheif 1.23.1; Meta Product Security team confirms functional RCE PoC
  • 2026-08-27: advisory: Sharp advisory GHSA-rgj7-g3m4-5g8c published
  • 2026-08-27: patched: sharp 0.35.4 released with libheif 1.23.2
  • 2026-09-08: other: Advisory published to GitHub Advisory Database

References