Executive brief
sharp is a popular image processing library that relies on libvips for handling various image formats including TIFF, GIF, and VIPS. Multiple vulnerabilities in the underlying libvips library allow attackers to trigger integer overflows and heap buffer overflows by supplying specially crafted image files, potentially leading to denial of service or arbitrary code execution when processing untrusted images.
Technical details
Four vulnerabilities were discovered and fixed in libvips (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591), with two rated as High severity using CVSS v4. The primary issues are integer overflow vulnerabilities in the vipsload and tiffload operations that can be exploited by providing malformed image files containing incorrect dimension or channel information. An attacker with local access (or an application receiving untrusted user-supplied images from the network) can exploit these by processing specially crafted GIF, TIFF, or VIPS images to trigger heap-based buffer overflows. The vulnerabilities were patched in libvips 8.18.1–8.18.3. Applications using sharp prior to version 0.35.0 (which bundles libvips 8.18.0 or earlier) are affected when processing untrusted input.
Affected products
- lovell sharp <0.35.0
- libvips libvips <=8.18.0
Timeline
- 2026-07-21: disclosed
- 2026-07-17: patched: libvips patches released (8.18.1–8.18.3); sharp 0.35.0+ includes patched libvips