CVE-2026-114111: falha de alta gravidade em lovell sharp
Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.9epss 0.1%
sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Produtos afetados
lovell · sharpCVEs relacionadas — lovell sharp
No mesmo produto, das mais perigosas para as menos.
CVE-2022-29256MEDIUMPossible vulnerability at 'npm install' time in sharp if an attacker has control over build environmentEPSS 0.4%CVE-2026-114112HIGHSharp before 0.35.4 RCE via bundled libheif AVIF decodingEPSS 0.2%CVE-2026-114113HIGHSharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image DecodersEPSS 0.1%