Sharp before version 0.35.5 contains a librsvg dependency that is vulnerable to a memory‑related flaw (CVE‑2026‑96889). When a crafted SVG image is processed, the underlying library may violate memory safety, allowing an attacker to execute arbitrary code on systems running glibc. The flaw can be triggered only when the image is decoded by Sharp, so the impact is at the application level but results in full system compromise once executed.

The vulnerability affects the Sharp image‑processing library from lovell, for all releases prior to 0.35.5. Systems deploying Sharp versions below 0.35.5 on Linux distributions that use glibc are susceptible. This includes Node.js environments that consume Sharp for image handling.

The CVSS score of 8.9 indicates a high severity, and the EPSS score shows a very low current exploitation probability (<1%). This flaw is not listed in the CISA KEV catalog. It can be exploited by delivering a malicious SVG file to an application that loads it via Sharp, leading to remote code execution in the context of the running process. No additional conditions have been reported, so exploitation is possible whenever untrusted SVG content is processed.