CVE-2026-114113 PUBLISHED

Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders

Assigner: VulnCheck
Reserved: 20.10.2026 Published: 21.10.2026 Updated: 21.10.2026

Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H
CVSS Score: 8.4

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Local	Confidentiality	Low	Confidentiality	Low
Attack Complexity	Low	Integrity	High	Integrity	High
Attack Requirements	None	Availability	High	Availability	High
Privileges Required	Low
User Interaction	None

CVSS 4.0

Product Status

Vendor	lovell
Product	sharp
Versions	Default: unaffected affected from 0 to 0.35.0 (excl.) Version 0.35.0 is unaffected

References

Problem Types

Dependency on Vulnerable Third-Party Component CWE