Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Medium severity, with a CVSS score of 4, published 8 September 2026.
- Which products and versions are affected?
- Sharp SEMVER:introduced=0,fixed=0.35.4.
- Is there a fix for This vulnerability?
- Yes. Sharp: upgrade to 0.35.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked with local access or from the adjacent network, in a software library.
- Am I affected?
- Check whether you run Sharp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Sharp: upgrade to 0.35.4 or later
Technical details
Multiple critical vulnerabilities have been discovered in the libheif dependency (versions ≤1.23.1) that stem from incorrect assumptions about image geometry and plane handling. Specifically, the code assumes that a HeifPixelImage's logical dimensions accurately describe every channel plane and that each heif_channel is backed by at most one plane—neither of which is enforced. By crafting a malformed HEIF/AVIF image with derived items (iden, auxl chains), an attacker can trigger out-of-bounds reads and writes, leading to RCE. Attack vector is local/adjacent since sharp itself has no networking, but applications using sharp to process untrusted uploaded images are at risk. The vulnerability affects sharp versions prior to 0.35.4, which bundles libheif 1.23.2. Patches are available; workaround is to disable HEIF decoding via sharp.block().
Affected products
- lovell sharp < 0.35.4
- struktur libheif <= 1.23.1
Timeline
- 2026-09-08: disclosed: GHSA-rgj7-g3m4-5g8c published
- 2026-09-08: patched: sharp 0.35.4 released with libheif 1.23.2