Vulnerability Disclosure

1 article

AI Security • Sep 20, 2026

Fix the libheif AVIF RCE: A CVSS 9.8 Bug in Sharp and Next.js

A CVSS 9.8 heap-buffer-overflow in libheif AVIF RCE (CVE-2026-84383) reaches Sharp, libvips, ImageMagick, and Next.js. Here's who's exposed and how to patch.

8 min read