Inheritance of High-Severity Vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

Executive Intelligence Brief

Multiple high-severity vulnerabilities have been discovered in the libvips dependency used by the sharp library. These vulnerabilities, with a CVSS score of 7, affect versions of sharp prior to 0.35.0. The vulnerabilities have been patched in sharp version 0.35.3, which includes libvips 8.18.3. Immediate upgrade is recommended to prevent potential exploitation.

Threat Overview

The sharp library, a popular high-performance image processing library for Node.js, has inherited multiple vulnerabilities from its dependency on libvips. libvips is a powerful image processing library used by sharp for various image operations. The vulnerabilities in question have been rated as 'High' severity under CVSSv4 and have been patched in the latest versions of sharp and libvips.

The affected versions of sharp are those prior to 0.35.0. This means any application or service utilizing sharp for image processing with versions older than 0.35.0 is potentially vulnerable to these issues. Given the widespread use of sharp in web applications for image handling, this vulnerability has significant implications for web security.

Technical Deep Dive

Vulnerability Classification

The vulnerabilities in libvips have been classified under CWE-1395, 'Dependency on Vulnerable Third-Party Component'. This classification highlights the risk associated with using third-party libraries, especially those with known vulnerabilities.

The CVSS vector for these vulnerabilities is: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N, with a score of 7. This indicates a high severity vulnerability that can be exploited locally with low attack complexity, requiring low privileges and no user interaction.

Root Cause Analysis

The root cause of these vulnerabilities lies in the libvips library, which sharp depends on for certain image processing operations. The specific coding or design flaws in libvips that led to these vulnerabilities are not detailed in the provided data, but it is clear that updating to a patched version of libvips (8.18.3) or sharp (0.35.3) resolves the issue.

Attack Vector & Chain

The attack vector for these vulnerabilities involves processing untrusted input with vulnerable versions of sharp. An attacker would need to convince or force a user to process maliciously crafted images using a vulnerable version of sharp. The exact attack path would involve the attacker providing a specially crafted image that, when processed by sharp (which in turn uses libvips), triggers one of the vulnerabilities.

Exploitation Scenario Walkthrough

Scenario: Remote Image Processing Exploitation

1. Reconnaissance: An attacker identifies a web application that uses the sharp library for image processing. The attacker determines that the version of sharp used is vulnerable (less than 0.35.0).

2. Weaponization: The attacker crafts a malicious image that, when processed by sharp, can exploit one of the vulnerabilities in libvips.

3. Delivery & Exploitation: The attacker uploads the malicious image to the web application, which then processes the image using sharp. The processing triggers the vulnerability in libvips, allowing the attacker to execute arbitrary code or achieve other malicious goals.

4. Post-Exploitation: After gaining initial access, the attacker could escalate privileges, move laterally within the network, or achieve other malicious objectives.

5. Impact Realization: The final impact could range from code execution on the server, data exfiltration, or disruption of service, depending on the attacker's goals and the specific vulnerability exploited.

Exploitation in the Wild

There is no indication that these vulnerabilities are being actively exploited in the wild at the time of the advisory. However, given their high severity and the widespread use of sharp, there is a significant risk of exploitation if systems are not promptly updated.

Impact Analysis

Direct Impact

The direct impact of these vulnerabilities includes potential code execution, privilege escalation, and data exposure for applications using vulnerable versions of sharp. The CVSS score of 7 indicates a high severity impact.

Downstream & Cascading Effects

The downstream effects could include supply chain risks, especially for applications and services that rely on sharp for image processing. Compromise of one system could lead to lateral movement within a network, affecting multiple systems and services.

Affected Products & Versions

The affected product is the sharp library, with versions prior to 0.35.0 being vulnerable. The patched version is 0.35.3, which includes libvips 8.18.3.

Detection & Threat Hunting

Indicators of Compromise

No specific indicators of compromise (IoCs) are provided in the source data. However, monitoring for unusual image processing activities or anomalies in system behavior post-update could help detect potential exploitation.

Detection Rules & Signatures

Detection logic could involve monitoring sharp library usage, especially for versions prior to 0.35.0, and looking for suspicious image processing patterns. Relevant MITRE ATT&CK techniques could include T1203 (Exploitation of Remote Services) and T1068 (Exploitation of Vulnerability).

Threat Hunting Queries

Threat hunting could involve searching for logs related to image processing, especially those indicating use of sharp, and checking system telemetry for signs of anomalous or malicious activity post-image processing.

Remediation & Hardening

Immediate Actions (0-24 hours)

1. **Upgrade sharp to version 0.35.3 or later**: This will ensure that the vulnerable libvips dependency is updated to a secure version (8.18.3).

2. **Apply Workarounds**: If immediate upgrade is not possible, add `sharp.block({ operation: ['VipsForeignLoadNsgif', 'VipsForeignLoadTiff', 'VipsForeignLoadVips'] });` to prevent sharp from decoding GIF, TIFF, and VIPS images.

Short-Term Hardening (1-7 days)

1. **Review and Update Dependencies**: Ensure all dependencies, especially those related to image processing, are up-to-date and patched.

2. **Enhance Monitoring**: Increase monitoring of image processing activities and system behaviors to quickly detect and respond to potential threats.

Strategic Recommendations

1. **Regularly Update Dependencies**: Implement a regular update and patching schedule for all dependencies to mitigate the risk of inherited vulnerabilities.

2. **Vulnerability Management**: Strengthen vulnerability management practices to identify and address potential vulnerabilities in dependencies proactively.

Analyst Assessment

Given the high severity of these vulnerabilities and their potential impact on applications using sharp for image processing, there is a significant risk of exploitation. Organizations should prioritize updating to the latest version of sharp and consider implementing additional security measures to detect and prevent exploitation.

Sources

• GitHub Security Advisories: https://github.com/advisories/GHSA-f88m-g3jw-g9cj