CVE-2026-114113 lovell CVE debrief

Who should care

Defenders responsible for systems using sharp should assess exposure and prioritize upgrading to sharp 0.35.3 or later, or ensure libvips 8.18.3 is used. This is crucial because the vulnerabilities in libvips could impact the security of systems processing untrusted input with affected versions of sharp. Defenders should also consider implementing workarounds to prevent sharp from decoding certain image types if an immediate upgrade is not feasible.

Why it matters

CVE-2026-114113: Multiple vulnerabilities in libvips affect sharp users. Defenders should prioritize upgrading sharp to 0.35.3 or later, or ensure libvips 8.18.3 is used.

• Verify and upgrade sharp to 0.35.3 or later to ensure patched libvips 8.18.3 is used
• Implement workarounds to prevent sharp from decoding GIF, TIFF, and VIPS images if upgrade is not feasible
• Assess exposure of systems processing untrusted input with sharp versions prior to 0.35.0

Technical summary

Multiple vulnerabilities were discovered in libvips, a dependency of sharp. Two of these vulnerabilities are rated as High severity using CVSSv4. Users processing untrusted input with sharp versions prior to 0.35.0 are affected. The vulnerabilities in libvips could lead to potential security issues if not addressed. Upgrading to sharp 0.35.3 or later, which includes libvips 8.18.3, will mitigate these risks. It is essential for defenders to assess their exposure and prioritize this upgrade to ensure the security of their systems.

Defensive priority

Defenders should prioritize upgrading sharp to 0.35.3 or later, or ensure libvips 8.18.3 is used, to address multiple vulnerabilities in libvips.

Recommended defensive actions

• Upgrade sharp to 0.35.3 or later
• Ensure libvips 8.18.3 is used
• Implement workarounds to prevent sharp from decoding certain image types
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The source corpus indicates multiple vulnerabilities were discovered in libvips, a dependency of sharp, with two rated as High severity. Those processing untrusted input with sharp versions prior to 0.35.0 are affected.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.