CVE-2026-106113
High
Description
ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process termination. Adaptive Histogram Equalization and AutoLevel are not affected by this report. This issue is fixed in version 4.1.2.
SeverityHigh
CVSS7.5
Exploit probability—
ProductSixlabors Imagesharp
PublishedOct 6, 2026
First seenOct 6, 2026
Weakness typeCWE-787Out-of-bounds write
How to fix
Update
- sixlabors imagesharp3.2.0, 4.1.2 or later
- SixLabors.ImageSharp3.2.0, 4.1.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sixlabors imagesharp | 2.0.0 ≤ v < 3.2.0, 4.0.0 ≤ v < 4.1.2 | 3.2.0, 4.1.2 |
| SixLabors.ImageSharpNuGet | 2.0.0 ≤ v < 3.2.0, 4.0.0 ≤ v < 4.1.2 | 3.2.0, 4.1.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.