CVE-2026-114111 PUBLISHED

Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability

Assigner: VulnCheck
Reserved: 20.10.2026 Published: 21.10.2026 Updated: 21.10.2026

sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 8.9

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Local	Confidentiality	High	Confidentiality	High
Attack Complexity	Low	Integrity	High	Integrity	High
Attack Requirements	Present	Availability	High	Availability	High
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	lovell
Product	sharp
Versions	Default: unaffected affected from 0 to 0.35.5 (excl.) Version 0.35.5 is unaffected

References

Problem Types

Use After Free CWE