Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-114111 · Microsoft / collected KEV context

EUVD-2026-106914

GHSA-j56w-ppx9-7qff

GHSA-wq5f-xc86-pv6w

cve-program · CVE-2026-114111

• https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w
• https://www.vulncheck.com/advisories/sharp-before-0.35.5-rce-via-librsvg-dependency-memory-vulnerability

euvd · EUVD-2026-106914

• https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w
• https://www.vulncheck.com/advisories/sharp-before-0.35.5-rce-via-librsvg-dependency-memory-vulnerability

nvd · CVE-2026-114111

• https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w
• https://www.vulncheck.com/advisories/sharp-before-0.35.5-rce-via-librsvg-dependency-memory-vulnerability

osv · GHSA-wq5f-xc86-pv6w

• https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w
• https://github.com/lovell/sharp/commit/96de105d9d36ab04c76c2b78b97255171630d236
• https://github.com/lovell/sharp
• https://github.com/lovell/sharp/releases/tag/v0.35.5
• https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241
• https://www.cve.org/CVERecord?id=CVE-2026-96889

No related operational record is retained in the current change model.