CVE-2026-106111
Description
ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR block's required size. ZipExrCompression.Decompress reconstructs the returned prefix while ExrDecoderCore processes the full expected block from a buffer obtained through Configuration.Default, allowing bytes retained from a completed prior ImageSharp operation to appear in decoded pixels. Applications that expose pixels or output from the later attacker-controlled EXR decode can disclose process-local image data. This issue is fixed in version 4.1.2.
How to fix
- sixlabors imagesharp4.1.2 or later
- SixLabors.ImageSharp4.1.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sixlabors imagesharp | 4.0.0 ≤ v < 4.1.2 | 4.1.2 |
| SixLabors.ImageSharpNuGet | 4.0.0 ≤ v < 4.1.2 | 4.1.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.