CVE-2026-114113

UNKNOWN 0.0

Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.

CWE	CWE-1395
Vendor	lovell
Product	sharp
Published	Oct 21, 2026

Stay Ahead of the Next One

Get instant alerts for lovell sharp

Be the first to know when new unknown vulnerabilities affecting lovell sharp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

lovell / sharp

0 < 0.35.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/lovell/sharp/security/advisories/GHSA-f88m-g3jw-g9cj vulncheck.com: https://www.vulncheck.com/advisories/sharp-before-0.35.0-multiple-vulnerabilities-via-bundled-libvips-image-decoders