CVE-2026-114113
Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities…
- Risk score
- 51/100
- CVSS
- 8.4 v4.0
- Exploit chance (30 days)
- 0.1%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input…
- Affected
- See advisory
- Fix
- Upgrade the product to 0.35.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.4 high
References
Original description
Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.
Last activity 21 Oct 2026. Patch Forecast updates every hour.