{"id":"CVE-2026-114113","aliases":[],"title":"Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders","titleSource":"VulnCheck","descriptionSource":"VulnCheck","products":[{"vendor":"lovell","name":"sharp","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"0.35.0","versionType":"semver"},{"version":"0.35.0","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-114113"}],"remediation":[],"description":"Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.","severity":"high","score":8.4,"published":"2026-10-21T00:37:11.824Z","modified":"2026-10-27T21:57:33.882Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://github.com/lovell/sharp/security/advisories/GHSA-f88m-g3jw-g9cj","https://www.vulncheck.com/advisories/sharp-before-0.35.0-multiple-vulnerabilities-via-bundled-libvips-image-decoders"],"sources":[{"name":"CVE","id":"CVE-2026-114113","modified":"2026-10-27T21:57:33.882Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-114113"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H","score":8.4}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T14:30:35.755Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}