CVE-2026-114111

Awaiting Analysis Awaiting Analysis - Queue

Memory Corruption in Sharp via librsvg

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: VulnCheck

Description

sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114111

EUVD

EUVD-2026-106914

Affected Vendors & Products

Vendor	Product	Version / Range
lovell	sharp	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability affects the npm package sharp (versions before 0.35.5) due to a memory-related flaw in its bundled librsvg dependency. An attacker can exploit this by providing a crafted SVG image that, when processed by sharp through librsvg on glibc-based Linux systems, may lead to arbitrary code execution under specific runtime conditions.

Detection Guidance

To detect this vulnerability, check the installed version of sharp using 'npm list sharp' or 'npm list -g sharp'. If the version is below 0.35.5, the system is vulnerable. Additionally, inspect the librsvg version with 'librsvg --version' or 'dpkg -l | grep librsvg' on Debian-based systems.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary code on your system, potentially leading to data theft, system compromise, or further network infiltration. Systems using sharp versions before 0.35.5 are at risk, especially if processing untrusted SVG images.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations must address it to maintain compliance, as exploitation may result in data breaches or loss of sensitive information.

Mitigation Strategies

Upgrade sharp to version 0.35.5 or later using 'npm update sharp'. If using a globally-installed librsvg, update it to version 2.63.2 or later. As a temporary workaround, disable SVG decoding in sharp by configuring it to reject SVG inputs.

Hi! I’m here to help you understand CVE-2026-114111. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...