Sharp (< 0.35.4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/sharp--0.35.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 08 Sep 2026 21:50:11 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCritical Remote Code Execution Vulnerabilities in libheif Affecting Sharphttps://feed.craftedsignal.io/briefs/2026-09-sharp-libheif-vulnerabilities/Tue, 08 Sep 2026 21:50:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-sharp-libheif-vulnerabilities/Multiple critical vulnerabilities in the libheif library, including CVE-2026-84383, enable potential remote code execution via malicious AVIF image processing in applications using the sharp npm package.Security researchers have identified multiple critical vulnerabilities within the libheif library, a dependency used by the sharp npm package for image processing. The vulnerabilities, notably tracked as CVE-2026-84383, arise during the parsing of HEIF/AVIF image formats. If an application using an affected version of sharp processes a specially crafted, malicious AVIF image, it can trigger memory corruption leading to potential remote code execution (RCE) on glibc-based Linux systems.

The impact is contingent on how the application handles untrusted image input. While the upstream libheif vulnerability is classified as critical, the sharp package maintainers have downgraded the severity to high as sharp itself does not provide native networking features. However, the risk remains significant for any system that ingests and processes images from external or untrusted sources. Users are strongly urged to upgrade to sharp version 0.35.4 or later, which incorporates the patched libheif version 1.23.2.

Impact

Successful exploitation could result in full remote code execution on the underlying host operating system. This vulnerability affects any service or infrastructure utilizing the sharp npm package (versions prior to 0.35.4) to decode HEIF/AVIF image files. Targeted sectors include web applications, content management systems, and image processing pipelines that accept user-submitted files.

Recommendation

  • Upgrade all instances of the sharp npm package to version 0.35.4 or later immediately.
  • For environments unable to update immediately, apply the code-level blocklist to disable HEIF/AVIF decoding: sharp.block({ operation: ["VipsForeignLoadHeif"] });.
  • Ensure the Node.js runtime environment is compiled as a Position Independent Executable (PIE) to provide exploit mitigations against RCE attempts, noting that official Node.js binaries may lack this configuration by default.
  • Audit image processing pipelines to identify and isolate services currently handling untrusted AVIF or HEIF file uploads.
]]>highadvisoryvulnerabilityrceimage-processinglibrary-vulnerability