{"id":"EUVD-2026-106914","enisaUuid":"7e225775-3491-39d3-a3ee-0d36dd4b28f7","description":"sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.","datePublished":"Oct 21, 2026, 12:37:10 AM","dateUpdated":"Oct 28, 2026, 1:49:52 PM","baseScore":8.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w\nhttps://www.vulncheck.com/advisories/sharp-before-0.35.5-rce-via-librsvg-dependency-memory-vulnerability\n","aliases":"CVE-2026-114111\nGHSA-j56w-ppx9-7qff\n","assigner":"VulnCheck","epss":0.13,"enisaIdProduct":[{"id":"4b5d5f9a-69d4-33ce-b2c1-c20300f099d2","product":{"name":"sharp","vendor":{"name":"code16"}},"product_version":"0 \u003c0.35.5"}],"enisaIdVendor":[{"id":"f66d67fe-9064-327d-9e2a-839efb9aa418","vendor":{"name":"lovell"}}],"enisaIdVulnerability":[{"id":"2c5a63c3-85e2-3b55-9b21-1b7ecfe9abb1","vulnerability":{"id":"GHSA-j56w-ppx9-7qff","description":"sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.","datePublished":"Oct 21, 2026, 3:32:27 AM","dateUpdated":"Oct 21, 2026, 3:32:27 AM","baseScore":0.0,"references":"https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114111\nhttps://www.vulncheck.com/advisories/sharp-before-0.35.5-rce-via-librsvg-dependency-memory-vulnerability\n","enisa_id":"EUVD-2026-106914\n","aliases":"GHSA-j56w-ppx9-7qff\nCVE-2026-114111\n","epss":0.0,"dataProcessed":"Oct 29, 2026, 7:03:23 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e6109316-41d0-314d-8a0a-2c610cf1e061","vulnerability":{"id":"CVE-2026-114111","description":"sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.","datePublished":"Oct 21, 2026, 12:37:10 AM","dateUpdated":"Oct 28, 2026, 1:49:52 PM","status":"PUBLISHED","baseScore":8.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w\nhttps://www.vulncheck.com/advisories/sharp-before-0.35.5-rce-via-librsvg-dependency-memory-vulnerability\n","enisa_id":"EUVD-2026-106914\n","assigner":"VulnCheck","epss":0.13,"dataProcessed":"Oct 30, 2026, 3:00:59 AM","vulnerabilityProduct":[{"id":"70752b4b-3961-30a7-acad-e423999a87ca","product":{"name":"sharp","vendor":{"name":"code16"}},"product_version":"0 \u003c0.35.5"}],"vulnerabilityVendor":[{"id":"24302f63-deb1-3054-8c4e-647d688589b9","vendor":{"name":"lovell"}}]}}],"enisaIdAdvisory":[]}