CVE-2026-114113: Dependency on Vulnerable Third-Party Component in lovell sharp

Sharp before version 0.35.0 bundles a vulnerable version of libvips that contains multiple security flaws (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591, CVE-2026-69242) in its GIF, TIFF, and VIPS image decoders. Applications using sharp to process untrusted image inputs may be exposed to these vulnerabilities, which can be triggered by crafted image files. The CVSS 4.0 score is 8.4 (high severity), indicating significant impact with local attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerabilities affect confidentiality, integrity, and availability with high impact. A patch is available in sharp version 0.35.0.

Exploitation of these vulnerabilities can lead to compromise of confidentiality, integrity, and availability of applications processing untrusted GIF, TIFF, or VIPS images via sharp. The attack requires local access with low complexity and no user interaction, but privileges are low. The vulnerabilities stem from the bundled libvips image decoders. No known exploits in the wild have been reported.

Upgrade sharp to version 0.35.0 or later, which includes a patched version of libvips addressing these vulnerabilities. Since this is a cloud service, the vendor manages remediation for hosted environments. Check the vendor advisory for confirmation and further guidance.