CVE-2026-106117
Description
ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width. T4TiffCompression.WritePixelRun can accumulate oversized makeup-code runs, and ModifiedHuffmanTiffCompression.Decompress validates the width only after writing. The unchecked writes can overflow the strip buffer, corrupt heap memory, and terminate the process. This strip-path vulnerability is distinct from the tiled decompressor-width mismatch. This issue is fixed in version 4.1.1.
How to fix
- sixlabors imagesharp3.2.0, 4.1.1 or later
- ImageSharp3.2.0, 4.1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sixlabors imagesharp | 3.0.0 ≤ v < 3.2.0, 4.0.0 ≤ v < 4.1.1 | 3.2.0, 4.1.1 |
| ImageSharpNuGet | 3.0.0 ≤ v < 3.2.0, 4.0.0 ≤ v < 4.1.1 | 3.2.0, 4.1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.