CVE-2026-114113

Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders

8.4 High

Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: High
Availability: High

Exploit likelihood

0.11%Unchanged since Oct 21, 2026

What each source reports

CVE List Score used 8.4

Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders

Record: CVE-2026-114113
CVSS 4.0: 8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H
Weakness: CWE-1395
Updated: 2026-11-02

EUVDEUVD-2026-106916 8.4

Record: EUVD-2026-106916
CVSS 4.0: 8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-7vv3-w8cj-2245 8.4

Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026...

Record: GHSA-7vv3-w8cj-2245
CVSS 4.0: 8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated: 2026-11-02

NVD 8.4

Record: CVE-2026-114113
CVSS 4.0: 8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated: 2026-11-02

OSV 8.4

Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders

Record: CVE-2026-114113
CVSS 4.0: 8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H
Weakness: CWE-1395
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-114113 is a high vulnerability (CVSS 8.4) in Code16 Sharp, published October 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. No source names a fixed version.