CVE WatchOct 21, 2026

CVE-2026-114113

Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2

CVSS

—

No CVSS

EPSS

0.1%

KEV

—

Exploit Today

0-100

Published: Oct 21, 2026 · Last modified: Oct 21, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.

Official references

github.comhttps://github.com/lovell/sharp/security/advisories/GHSA-f88m-g3jw-g9cj
www.vulncheck.comhttps://www.vulncheck.com/advisories/sharp-before-0.35.0-multiple-vulnerabilities-via-bundled-libvips-image-decoders

Related CVEs

No related CVEs by CWE or product.