CVE-2026-114113

Awaiting Analysis Awaiting Analysis - Queue

Heap Buffer Overflow in Sharp Image Processing Library

Publication date: 2026-10-21

Last updated on: 2026-10-27

Assigner: VulnCheck

Description

Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114113

EUVD

EUVD-2026-106916

Affected Vendors & Products

Vendor	Product	Version / Range
lovell	sharp	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects Sharp versions before 0.35.0 due to its inclusion of a vulnerable libvips library in image decoders for GIF, TIFF, and VIPS formats. Attackers can exploit this by providing maliciously crafted files to applications using Sharp, potentially leading to security issues when processing untrusted input.

Detection Guidance

Check the version of Sharp installed on your system using the command 'npm list sharp' or 'sharp -v'. If the version is below 0.35.0, your system is vulnerable. Additionally, inspect applications using Sharp to process untrusted image files, particularly those handling GIF, TIFF, or VIPS formats.

Impact Analysis

If you use Sharp before version 0.35.0, attackers could exploit this vulnerability by supplying specially crafted image files. This may lead to unauthorized access, data corruption, or denial of service in applications processing these files. The high CVSS score of 8.4 indicates significant potential impact.

Compliance Impact

The vulnerability in Sharp before 0.35.0, caused by bundled vulnerable libvips versions, may lead to unauthorized access or modification of sensitive data when processing untrusted image files. This could impact compliance with GDPR (data integrity and confidentiality) and HIPAA (protected health information integrity) if exploited.

Mitigation Strategies

Update Sharp to version 0.35.0 or later immediately. If updating is not possible, consider blocking the processing of GIF, TIFF, and VIPS files as a temporary workaround. Monitor for any suspicious activity related to image file processing.

Hi! I’m here to help you understand CVE-2026-114113. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...