sharp EUVD-2026-106914

Exploitation requires the application to decode an attacker-supplied SVG image through sharp's librsvg-backed loader (VipsForeignLoadSvg) using a vulnerable sharp (< 0.35.5) with the pre-0.35.5 bundled librsvg (before 2.63.2). Reaching code execution is further constrained to glibc-based Linux and to node executables NOT compiled as Position Independent Executables (PIE) - the advisory explicitly notes that PIE-hardened node, used by most Linux package managers, prevents RCE, while the 'official' Node.js binaries are not PIE and remain exposed. Limiting/mitigating factors: SVG decoding must be enabled (it can be fully disabled via sharp.block({ operation: ['VipsForeignLoadSvg'] })), the host must be glibc Linux, and additional unspecified 'runtime-specific conditions' must align; absent these the flaw degrades to a memory-corruption/crash rather than reliable RCE.

The input assigns CVSS 4.0 8.9 (High) via CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N with high impact across both the vulnerable and subsequent system, reflecting a use-after-free (CWE-416) in the bundled librsvg dependency (CVE-2026-96889) that can yield RCE. Crucially, the raw score overstates turnkey risk: the GHSA advisory and description repeatedly qualify the outcome as occurring only 'under certain runtime-specific conditions' and 'may result' in code execution - captured by AT:P (attack requirements present) - and the advisory names a hard precondition that RCE is avoided entirely if the node executable is compiled as a Position Independent Executable (PIE), which most Linux package managers already enforce (only the official Node.js binaries are not PIE). There is NO EPSS score, NO CISA KEV listing, and NO public exploit provided in the input, so exploitation is 'no public exploit identified at time of analysis' - this should be treated as a conditional, defense-in-depth memory-safety fix rather than evidence of imminent mass exploitation. There is also a signal conflict worth verifying: the official vector uses AV:L (local), yet the description frames the threat as 'an attacker can supply a crafted SVG image' decoded by sharp, which in typical web/upload pipelines is a network-delivered, unauthenticated input (PR:N/UI:N) - verify with the vendor whether AV:L reflects a specific local-delivery assumption or is conservative. Net: a credible RCE primitive, but gated by glibc-based Linux, non-PIE node, and active SVG decoding, placing it below unconditional-critical priority.

An application uses sharp (< 0.35.5) to process user-supplied images on a glibc-based Linux host where the node runtime is not PIE-hardened; an attacker submits a crafted SVG that sharp hands to librsvg for decoding. The malformed SVG triggers the use-after-free in librsvg, and under the right runtime conditions the corrupted memory is leveraged to execute arbitrary code in the context of the Node.js process. No public proof-of-concept is identified in the provided data, and success depends on the non-default-hardening and platform conditions noted in the advisory.