CVE-2026-114113

None

CVSS

—

EPSS

0.1%

Published

Oct 21, 2026

CISA due date

—

The record

Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.

Affected packages

Ecosystem	Package	Introduced	Fixed