Read the docs
TI-2026-78726 Aliases CVE-2026-114113

Bundled libvips flaws in Sharp expose apps to crafted images

Priority MEDIUM 43CWE-1395Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · High · High
Fix status
Partial Red Hat: 4 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Sharp before 0.35.0 bundles a version of libvips affected by multiple flaws in its GIF, TIFF and VIPS image decoders. The flaw is a dependency on a vulnerable third-party component (CWE-1395). A local attacker with low privileges can trigger these flaws by supplying crafted GIF, TIFF or VIPS files to an application that uses sharp to process untrusted input.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00107 1st percentileScored 2026-11-07
Fix Partial sharp (lovell): 0.35.0Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
lovellsharpbefore 0.35.00.35.0Patch availableCNA
  • sharp Vendorlovell Affected before 0.35.0 Fixed in 0.35.0 Patch available CNA

Remediation

Upgrade sharp to version 0.35.0. Red Hat lists Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat Openshift Data Foundation 4 and Red Hat Trusted Artifact Signer as affected, with no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA sharp (lovell) Fixed in 0.35.0

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Trusted Artifact SignerAffectedNo fix yet
Not affected: 1 product
  • Red Hat Build of Podman Desktop

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-114113
  2. 2026-10-21 Affected versions changed · Red Hat
  3. 2026-10-22 Priority changed: MEDIUM → LOW
  4. 2026-10-27 CISA SSVC decision points changed
  5. 2026-10-27 Priority changed: LOW → MEDIUM

References

Advisory 1

  • TI-2026-78725 Sharp image library's bundled libheif allows remote code execution CVSS 4.0HIGH 8.9
  • TI-2026-78724 Use after free in sharp's bundled librsvg allows code execution CVSS 4.0HIGH 8.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences