CVE-2026-114111 lovell CVE debrief

Who should care

Defenders responsible for systems using the sharp library, especially those using prebuilt binaries or a globally-installed librsvg, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-114111 is a memory-related vulnerability in the librsvg dependency of the sharp library, potentially leading to remote code execution on glibc-based Linux. Defenders should prioritize upgrading to the latest sharp or librsvg versions and consider workarounds to prevent exploitation.

• Possible remote code execution on glibc-based Linux systems
• Need to verify and upgrade to the latest sharp or librsvg versions
• Potential for attackers to exploit if not patched
• Requires verification of node executable binary compilation

Technical summary

The vulnerability is in the librsvg dependency of the sharp library. It can lead to remote code execution on glibc-based Linux under certain conditions. The issue is fixed in sharp version 0.35.5 with librsvg 2.63.2. Affected product deployments should be identified in managed environments, and owners should be assigned for follow-up. The official advisory or CVE record should be reviewed to validate affected scope, severity, and vendor guidance. Vendor-supported updates or mitigations should be planned through normal change control where exposure is confirmed.

Defensive priority

Defenders should prioritize upgrading to the latest version of sharp or ensuring the latest librsvg is installed. They should also consider implementing workarounds to prevent exploitation.

Recommended defensive actions

• Upgrade to the latest version of sharp (0.35.5 or later)
• Ensure the latest librsvg (2.63.2 or later) is installed if not using prebuilt sharp binaries
• Implement workarounds to prevent sharp from decoding SVG images
• Verify node executable binary is compiled as a Position Independent Executable (PIE)
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was discovered in the librsvg dependency of the sharp library. The sharp library provides prebuilt binaries, and users of these binaries should upgrade to version 0.35.5. Users with a globally-installed librsvg should ensure they are using version 2.63.2.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.