CVE-2026-106114
Description
ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and earlier public IccProfile.Entries parsing paths can allocate a large jagged representation, from a short truncated profile. In version 4, automatic image conversion reaches the parser when DecoderOptions.ColorProfileHandling is Convert; the default Preserve mode avoids that conversion path. The demonstrated impact is memory pressure and input-validation failure, not unhandled process termination. This issue is fixed in version 4.1.2.
How to fix
- sixlabors imagesharp3.2.0, 4.1.2 or later
- SixLabors.ImageSharp4.1.2, 3.2.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sixlabors imagesharp | 1.0.0 ≤ v < 3.2.0, 4.0.0 ≤ v < 4.1.2 | 3.2.0, 4.1.2 |
| SixLabors.ImageSharpNuGet | 4.0.0 ≤ v < 4.1.2, 1.0.0-beta0001 ≤ v < 3.2.0 | 4.1.2, 3.2.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.