Sharp before 0.35.0 bundles a copy of libvips that is known to include multiple vulnerabilities (CVE‑2026‑33327, CVE‑2026‑33328, CVE‑2026‑35590, CVE‑2026‑35591, CVE‑2026‑69242) in its GIF, TIFF and VIPS decoders. Attackers can provide crafted image files in these formats to an application using Sharp, triggering the underlying libvips flaws. The CVE lists the weaknesses under CWE‑1395 and CWE‑829, indicating issues with resource exhaustion and improper restriction of privileges. Although the CVE description does not specify a confirmed outcome, exploitation of these flaws could compromise the stability or correctness of the application that processes malicious input.

All installations of lovell:sharp older than 0.35.0 that handle GIF, TIFF, or VIPS images are impacted. The issue is independent of operating system; any software that imports Sharp and processes these formats from untrusted sources is susceptible.

The CVSS score of 8.4 signals high severity. The EPSS score of less than 1 % indicates a very low current exploitation probability. Sharp is not listed in the CISA KEV catalog. The most likely attack vector is the injection of a malicious image file into a Sharp‑enabled application; if the application runs with elevated privileges, exploitation could lead to serious damage.