---
id: CVE-2026-114113
title: >-
  Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image
  Decoders
summary: >-
  Sharp before 0.35.0 bundles a version of libvips affected by multiple
  vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590,
  CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders.
  Attackers can supply craf…
severity: high
cvss: 8.4
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H'
cvssSource: cna
cwe:
  - CWE-1395
vendor: lovell
product: sharp
affected:
  - sharp < 0.35.0
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T00:37:11.824Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114113'
references:
  - url: 'https://github.com/lovell/sharp/security/advisories/GHSA-f88m-g3jw-g9cj'
    label: GitHub Security Advisory (GHSA-f88m-g3jw-g9cj)
  - url: >-
      https://www.vulncheck.com/advisories/sharp-before-0.35.0-multiple-vulnerabilities-via-bundled-libvips-image-decoders
    label: >-
      VulnCheck Advisory: Sharp before 0.35.0 Multiple Vulnerabilities via
      Bundled libvips Image Decoders
tags:
  - cve.org
ingestedAt: '2026-10-21T01:37:08.010Z'
---

## Overview

Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.

## Affected

- `sharp < 0.35.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.