{"id":"EUVD-2026-106916","enisaUuid":"9d7aaaff-912f-3f9f-8ffa-e047823a9a32","description":"Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.","datePublished":"Oct 21, 2026, 12:37:11 AM","dateUpdated":"Oct 27, 2026, 9:57:33 PM","baseScore":8.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H","references":"https://github.com/lovell/sharp/security/advisories/GHSA-f88m-g3jw-g9cj\nhttps://www.vulncheck.com/advisories/sharp-before-0.35.0-multiple-vulnerabilities-via-bundled-libvips-image-decoders\n","aliases":"CVE-2026-114113\nGHSA-7vv3-w8cj-2245\n","assigner":"VulnCheck","epss":0.11,"enisaIdProduct":[{"id":"0939c29f-3f47-3862-bb6e-d87df2b55ae2","product":{"name":"sharp","vendor":{"name":"code16"}},"product_version":"0 \u003c0.35.0"}],"enisaIdVendor":[{"id":"3f9f9776-c88a-3aed-9a6a-1da36d07f20a","vendor":{"name":"lovell"}}],"enisaIdVulnerability":[{"id":"6336ef5f-2f08-32ed-8e8f-c0ce9d9ee628","vulnerability":{"id":"CVE-2026-114113","description":"Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.","datePublished":"Oct 21, 2026, 12:37:11 AM","dateUpdated":"Oct 27, 2026, 9:57:33 PM","status":"PUBLISHED","baseScore":8.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H","references":"https://github.com/lovell/sharp/security/advisories/GHSA-f88m-g3jw-g9cj\nhttps://www.vulncheck.com/advisories/sharp-before-0.35.0-multiple-vulnerabilities-via-bundled-libvips-image-decoders\n","enisa_id":"EUVD-2026-106916\n","assigner":"VulnCheck","epss":0.11,"dataProcessed":"Oct 29, 2026, 11:01:03 PM","vulnerabilityProduct":[{"id":"e1af1cf3-910b-3147-9202-51e3e04b6036","product":{"name":"sharp","vendor":{"name":"code16"}},"product_version":"0 \u003c0.35.0"}],"vulnerabilityVendor":[{"id":"2415c071-16d0-38a0-91cd-c2fac742f514","vendor":{"name":"lovell"}}]}},{"id":"a698d440-721c-33fd-a746-f996c797ae39","vulnerability":{"id":"GHSA-7vv3-w8cj-2245","description":"Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.","datePublished":"Oct 21, 2026, 3:32:27 AM","dateUpdated":"Oct 21, 2026, 3:32:28 AM","baseScore":0.0,"references":"https://github.com/lovell/sharp/security/advisories/GHSA-f88m-g3jw-g9cj\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114113\nhttps://www.vulncheck.com/advisories/sharp-before-0.35.0-multiple-vulnerabilities-via-bundled-libvips-image-decoders\n","enisa_id":"EUVD-2026-106916\n","aliases":"CVE-2026-114113\nGHSA-7vv3-w8cj-2245\n","epss":0.0,"dataProcessed":"Oct 29, 2026, 7:03:23 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}