CVE-2026-114113High· 8.4▾ TwilightSharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply craf…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.
sharp < 0.35.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
GHSA-f88m-g3jw-g9cjHighsharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591
GHSA-wq5f-xc86-pv6wHighsharp : Vulnerability in librsvg dependency CVE-2026-96889
CVE-2026-114112High· 8.9Sharp before 0.35.4 RCE via bundled libheif AVIF decoding
CVE-2026-114111High· 8.9Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability
CVE-2026-61825High· 8.7code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces
CVE-2026-61823High· 7.3code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces