GHSA-54xq-cgqr-rpm3

What it actually does

Heap buffer overflow in libwebp WebP decoding used by sharp allows out-of-bounds memory writes during image processing.

Why it matters to the business

Applications processing images with affected sharp versions risk remote code execution or crashes when handling malicious WebP files, potentially compromising servers or disrupting services.

How an attack unfolds

An attacker crafts a malicious WebP image exploiting the libwebp buffer overflow and delivers it to an application endpoint that uses vulnerable sharp for image processing, triggering arbitrary code execution upon decoding.

How to fix it

Upgrade sharp to version 0.32.6 or later.

How to confirm the fix worked

Confirm installed sharp version meets or exceeds 0.32.6; test image processing pipelines with known WebP test cases that previously triggered the overflow.

Typical attack path

1. Locate application functionality that accepts or processes WebP images via sharp
2. Generate a specially crafted WebP payload targeting the known libwebp overflow
3. Submit the payload through upload, URL fetch, or API processing
4. Trigger decoding to achieve code execution or denial of service

How to detect it

Review application and system logs for crashes or unexpected behavior during WebP image processing; correlate with file upload timestamps and monitor for anomalous child processes spawned from image-handling services.

What your security team should do

• Upgrade all instances of sharp to 0.32.6 immediately
• Audit package manifests and lockfiles across repositories for vulnerable sharp versions
• Add runtime checks or sandboxing around image processing where upgrades are delayed