CVE-2026-114111: Use After Free in lovell sharp
Description
A use-after-free vulnerability exists in the sharp library before version 0.35.5 due to a vulnerable librsvg dependency (CVE-2026-96889). This flaw can be triggered by processing a crafted SVG image, potentially leading to arbitrary code execution on glibc-based Linux systems. The vulnerability has a high severity score of 8.9 and affects versions of sharp from the initial release up to but not including 0.35.5.
CVSS v4.0
Score 8.9high
Affected software
lovell
sharp
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The sharp library versions prior to 0.35.5 include a bundled librsvg dependency that contains a memory-related vulnerability (CVE-2026-96889). Under specific runtime conditions on glibc-based Linux systems, this vulnerability can be exploited by an attacker supplying a crafted SVG image. When sharp decodes this image through librsvg, it may result in arbitrary code execution due to a use-after-free condition.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary code on affected systems running glibc-based Linux, potentially leading to full system compromise. The vulnerability requires the attacker to supply a malicious SVG image that is processed by the vulnerable sharp library.
Mitigation Recommendations
Upgrade sharp to version 0.35.5 or later, where the vulnerable librsvg dependency is no longer bundled or has been patched. No other mitigation details are provided; applying the official fix is recommended.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-20T21:48:58.503Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad80c0a2cdf04f6568caa62
Added to database: 10/21/2026, 00:49:14 UTC
Last enriched: 10/21/2026, 01:03:32 UTC
Last updated: 10/21/2026, 01:08:24 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.