Search
Find a vulnerability
Search criteria
16 vulnerabilities by sixlabors
CVE-2026-106118 (GCVE-0-2026-106118)
Vulnerability from cvelistv5 – Published: 2026-10-06 17:59 – Updated: 2026-10-06 19:29
VLAI
EPSS
VEX
Title
ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write
Summary
ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constructs T4, T6, and Modified Huffman decompressors using the full frame width. TiffDecoderCore.DecodeTilesChunky can therefore direct frame-width fax scanlines into a tile-width buffer when TileWidth is smaller than ImageWidth. The mismatch causes attacker-controlled out-of-bounds writes, heap corruption, and process termination even with legal per-row run codes. This tiled-path vulnerability is distinct from oversized CCITT runs in strip decoding. This issue is fixed in version 4.1.1.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:27 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/SixLabors/ImageSharp/security/… | x_refsource_CONFIRM |
| https://github.com/SixLabors/ImageSharp/pull/3176 | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/commit/9e… | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SixLabors | ImageSharp |
Affected:
>= 3.0.0, < 4.1.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106118",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:27:52.241408Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:29:39.226Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ImageSharp",
"vendor": "SixLabors",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 4.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constructs T4, T6, and Modified Huffman decompressors using the full frame width. TiffDecoderCore.DecodeTilesChunky can therefore direct frame-width fax scanlines into a tile-width buffer when TileWidth is smaller than ImageWidth. The mismatch causes attacker-controlled out-of-bounds writes, heap corruption, and process termination even with legal per-row run codes. This tiled-path vulnerability is distinct from oversized CCITT runs in strip decoding. This issue is fixed in version 4.1.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:59:02.778Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-v76p-62qx-wwq2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-v76p-62qx-wwq2"
},
{
"name": "https://github.com/SixLabors/ImageSharp/pull/3176",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/pull/3176"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/9ee7d1dd5b62d8c9f16cc755e76828386bc2191f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/9ee7d1dd5b62d8c9f16cc755e76828386bc2191f"
},
{
"name": "https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1"
}
],
"source": {
"advisory": "GHSA-v76p-62qx-wwq2",
"discovery": "UNKNOWN"
},
"title": "ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth \u2014 heap OOB write"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106118",
"datePublished": "2026-10-06T17:59:02.778Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-06T19:29:39.226Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106117 (GCVE-0-2026-106117)
Vulnerability from cvelistv5 – Published: 2026-10-06 17:53 – Updated: 2026-10-06 18:20
VLAI
EPSS
VEX
Title
ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp
Summary
ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width. T4TiffCompression.WritePixelRun can accumulate oversized makeup-code runs, and ModifiedHuffmanTiffCompression.Decompress validates the width only after writing. The unchecked writes can overflow the strip buffer, corrupt heap memory, and terminate the process. This strip-path vulnerability is distinct from the tiled decompressor-width mismatch. This issue is fixed in version 4.1.1.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 18:19 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/SixLabors/ImageSharp/security/… | x_refsource_CONFIRM |
| https://github.com/SixLabors/ImageSharp/pull/3176 | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/commit/e8… | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SixLabors | ImageSharp |
Affected:
>= 3.0.0, < 4.1.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106117",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T18:19:48.989417Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:20:09.862Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jj3q-cwqj-842r"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ImageSharp",
"vendor": "SixLabors",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 4.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width. T4TiffCompression.WritePixelRun can accumulate oversized makeup-code runs, and ModifiedHuffmanTiffCompression.Decompress validates the width only after writing. The unchecked writes can overflow the strip buffer, corrupt heap memory, and terminate the process. This strip-path vulnerability is distinct from the tiled decompressor-width mismatch. This issue is fixed in version 4.1.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:53:46.448Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jj3q-cwqj-842r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jj3q-cwqj-842r"
},
{
"name": "https://github.com/SixLabors/ImageSharp/pull/3176",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/pull/3176"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/e8892ecd8a95dee95c4480fda51cfe0b32f3b846",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/e8892ecd8a95dee95c4480fda51cfe0b32f3b846"
},
{
"name": "https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1"
}
],
"source": {
"advisory": "GHSA-jj3q-cwqj-842r",
"discovery": "UNKNOWN"
},
"title": "ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer \u2014 heap OOB write in SixLabors.ImageSharp"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106117",
"datePublished": "2026-10-06T17:53:46.448Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-06T18:20:09.862Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106116 (GCVE-0-2026-106116)
Vulnerability from cvelistv5 – Published: 2026-10-06 17:51 – Updated: 2026-10-06 18:21
VLAI
EPSS
VEX
Title
ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop
Summary
ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without advancing the stream or terminating the outer loop, so a small malformed BigTIFF can keep one decoder thread executing for an attacker-controlled duration. This report does not claim worker-pool exhaustion. This issue is fixed in version 4.1.2.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 18:21 UTC
CWE
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/SixLabors/ImageSharp/security/… | x_refsource_CONFIRM |
| https://github.com/SixLabors/ImageSharp/pull/3187 | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/commit/92… | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SixLabors | ImageSharp |
Affected:
>= 2.0.0, < 4.1.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106116",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T18:21:43.778832Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:21:55.088Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ImageSharp",
"vendor": "SixLabors",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c 4.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without advancing the stream or terminating the outer loop, so a small malformed BigTIFF can keep one decoder thread executing for an attacker-controlled duration. This report does not claim worker-pool exhaustion. This issue is fixed in version 4.1.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:51:36.366Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g"
},
{
"name": "https://github.com/SixLabors/ImageSharp/pull/3187",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/pull/3187"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec"
},
{
"name": "https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"
}
],
"source": {
"advisory": "GHSA-wmxv-xphr-5c9g",
"discovery": "UNKNOWN"
},
"title": "ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106116",
"datePublished": "2026-10-06T17:51:36.366Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-06T18:21:55.088Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106115 (GCVE-0-2026-106115)
Vulnerability from cvelistv5 – Published: 2026-10-06 17:50 – Updated: 2026-10-09 01:20
VLAI
EPSS
VEX
Title
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
Summary
ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked writes, and a decode-and-re-encode flow can inherit TiffCompression.CcittGroup4Fax and one-bit metadata from attacker-supplied input. The resulting out-of-bounds writes can corrupt memory and terminate the process. This issue is fixed in version 4.1.2.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 01:20 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/SixLabors/ImageSharp/security/… | x_refsource_CONFIRM |
| https://github.com/SixLabors/ImageSharp/pull/3187 | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/commit/a9… | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SixLabors | ImageSharp |
Affected:
>= 2.1.0, < 4.1.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106115",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T01:20:30.658521Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T01:20:52.111Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ImageSharp",
"vendor": "SixLabors",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.1.0, \u003c 4.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked writes, and a decode-and-re-encode flow can inherit TiffCompression.CcittGroup4Fax and one-bit metadata from attacker-supplied input. The resulting out-of-bounds writes can corrupt memory and terminate the process. This issue is fixed in version 4.1.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:50:15.754Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w"
},
{
"name": "https://github.com/SixLabors/ImageSharp/pull/3187",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/pull/3187"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95"
},
{
"name": "https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"
}
],
"source": {
"advisory": "GHSA-jjfr-hcj7-qf5w",
"discovery": "UNKNOWN"
},
"title": "ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106115",
"datePublished": "2026-10-06T17:50:15.754Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-09T01:20:52.111Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106114 (GCVE-0-2026-106114)
Vulnerability from cvelistv5 – Published: 2026-10-06 17:48 – Updated: 2026-10-06 19:44
VLAI
EPSS
VEX
Title
ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions
Summary
ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and earlier public IccProfile.Entries parsing paths can allocate a large jagged representation, from a short truncated profile. In version 4, automatic image conversion reaches the parser when DecoderOptions.ColorProfileHandling is Convert; the default Preserve mode avoids that conversion path. The demonstrated impact is memory pressure and input-validation failure, not unhandled process termination. This issue is fixed in version 4.1.2.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:44 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/SixLabors/ImageSharp/security/… | x_refsource_CONFIRM |
| https://github.com/SixLabors/ImageSharp/pull/3187 | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/commit/8d… | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SixLabors | ImageSharp |
Affected:
>= 1.0.0-beta0001, < 4.1.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106114",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:44:02.412151Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:44:26.694Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ImageSharp",
"vendor": "SixLabors",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.0-beta0001, \u003c 4.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and earlier public IccProfile.Entries parsing paths can allocate a large jagged representation, from a short truncated profile. In version 4, automatic image conversion reaches the parser when DecoderOptions.ColorProfileHandling is Convert; the default Preserve mode avoids that conversion path. The demonstrated impact is memory pressure and input-validation failure, not unhandled process termination. This issue is fixed in version 4.1.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:48:41.736Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44"
},
{
"name": "https://github.com/SixLabors/ImageSharp/pull/3187",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/pull/3187"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df"
},
{
"name": "https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"
}
],
"source": {
"advisory": "GHSA-gwg2-r3hj-4w44",
"discovery": "UNKNOWN"
},
"title": "ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106114",
"datePublished": "2026-10-06T17:48:41.736Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-06T19:44:26.694Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106113 (GCVE-0-2026-106113)
Vulnerability from cvelistv5 – Published: 2026-10-06 17:47 – Updated: 2026-10-07 17:07
VLAI
EPSS
VEX
Title
ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index
Summary
ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process termination. Adaptive Histogram Equalization and AutoLevel are not affected by this report. This issue is fixed in version 4.1.2.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 15:39 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/SixLabors/ImageSharp/security/… | x_refsource_CONFIRM |
| https://github.com/SixLabors/ImageSharp/pull/3187 | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/commit/c4… | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SixLabors | ImageSharp |
Affected:
>= 2.0.0, < 4.1.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106113",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T15:39:17.492179Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T17:07:48.107Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ImageSharp",
"vendor": "SixLabors",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c 4.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image\u003cHalfVector4\u003e and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process termination. Adaptive Histogram Equalization and AutoLevel are not affected by this report. This issue is fixed in version 4.1.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:47:17.503Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4"
},
{
"name": "https://github.com/SixLabors/ImageSharp/pull/3187",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/pull/3187"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d"
},
{
"name": "https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"
}
],
"source": {
"advisory": "GHSA-j3p4-wp97-rph4",
"discovery": "UNKNOWN"
},
"title": "ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106113",
"datePublished": "2026-10-06T17:47:17.503Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-07T17:07:48.107Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106112 (GCVE-0-2026-106112)
Vulnerability from cvelistv5 – Published: 2026-10-06 17:45 – Updated: 2026-10-06 18:22
VLAI
EPSS
VEX
Title
ImageSharp: ICC LUT16 output channel count can write beyond Vector4
Summary
ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ICC LUT16 conversion accepts more than four output channels even though ClutCalculator.Calculate and LutEntryCalculator.CalculateLut store intermediate and output values in Vector4. When DecoderOptions.ColorProfileHandling is set to Convert, a malformed embedded profile can direct interpolation and output-LUT operations to write one float per declared channel beyond the four-float destination. This can corrupt memory and terminate the process; the default Preserve mode does not run ICC conversion. This issue is fixed in version 4.1.2.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 18:21 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/SixLabors/ImageSharp/security/… | x_refsource_CONFIRM |
| https://github.com/SixLabors/ImageSharp/pull/3187 | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/commit/b0… | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SixLabors | ImageSharp |
Affected:
>= 4.0.0, < 4.1.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106112",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T18:21:59.947801Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:22:14.883Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-ffp7-56pq-64mr"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ImageSharp",
"vendor": "SixLabors",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ICC LUT16 conversion accepts more than four output channels even though ClutCalculator.Calculate and LutEntryCalculator.CalculateLut store intermediate and output values in Vector4. When DecoderOptions.ColorProfileHandling is set to Convert, a malformed embedded profile can direct interpolation and output-LUT operations to write one float per declared channel beyond the four-float destination. This can corrupt memory and terminate the process; the default Preserve mode does not run ICC conversion. This issue is fixed in version 4.1.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:45:58.944Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-ffp7-56pq-64mr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-ffp7-56pq-64mr"
},
{
"name": "https://github.com/SixLabors/ImageSharp/pull/3187",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/pull/3187"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/b03f0ed7e5be760eecc740fa53dd166b18ae9b23",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/b03f0ed7e5be760eecc740fa53dd166b18ae9b23"
},
{
"name": "https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"
}
],
"source": {
"advisory": "GHSA-ffp7-56pq-64mr",
"discovery": "UNKNOWN"
},
"title": "ImageSharp: ICC LUT16 output channel count can write beyond Vector4"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106112",
"datePublished": "2026-10-06T17:45:58.944Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-06T18:22:14.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106111 (GCVE-0-2026-106111)
Vulnerability from cvelistv5 – Published: 2026-10-06 17:44 – Updated: 2026-10-06 18:18
VLAI
EPSS
VEX
Title
ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate
Summary
ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR block's required size. ZipExrCompression.Decompress reconstructs the returned prefix while ExrDecoderCore processes the full expected block from a buffer obtained through Configuration.Default, allowing bytes retained from a completed prior ImageSharp operation to appear in decoded pixels. Applications that expose pixels or output from the later attacker-controlled EXR decode can disclose process-local image data. This issue is fixed in version 4.1.2.
Severity
5.9 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 18:18 UTC
CWE
- CWE-226 - Sensitive Information in Resource Not Removed Before Reuse
Assigner
GitHub_M
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/SixLabors/ImageSharp/security/… | x_refsource_CONFIRM |
| https://github.com/SixLabors/ImageSharp/pull/3187 | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/commit/3c… | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/commit/6e… | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SixLabors | ImageSharp |
Affected:
>= 4.0.0, < 4.1.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106111",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T18:18:45.477260Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:18:50.655Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-4q3p-rj5x-xv7p"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ImageSharp",
"vendor": "SixLabors",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR block\u0027s required size. ZipExrCompression.Decompress reconstructs the returned prefix while ExrDecoderCore processes the full expected block from a buffer obtained through Configuration.Default, allowing bytes retained from a completed prior ImageSharp operation to appear in decoded pixels. Applications that expose pixels or output from the later attacker-controlled EXR decode can disclose process-local image data. This issue is fixed in version 4.1.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-226",
"description": "CWE-226: Sensitive Information in Resource Not Removed Before Reuse",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:44:24.782Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-4q3p-rj5x-xv7p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-4q3p-rj5x-xv7p"
},
{
"name": "https://github.com/SixLabors/ImageSharp/pull/3187",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/pull/3187"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/3c43cf583fdd98eff0f451397affaa31c6a2e6b1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/3c43cf583fdd98eff0f451397affaa31c6a2e6b1"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/6ed2a275217d39301e76df42acec2a9533b39d2b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/6ed2a275217d39301e76df42acec2a9533b39d2b"
},
{
"name": "https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"
}
],
"source": {
"advisory": "GHSA-4q3p-rj5x-xv7p",
"discovery": "UNKNOWN"
},
"title": "ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106111",
"datePublished": "2026-10-06T17:44:24.782Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-06T18:18:50.655Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106110 (GCVE-0-2026-106110)
Vulnerability from cvelistv5 – Published: 2026-10-06 17:42 – Updated: 2026-10-09 01:19
VLAI
EPSS
VEX
Title
ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer
Summary
ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and T4BitCompressor.CompressStrip reaches unchecked writes when TiffCompression.CcittGroup3Fax is selected directly or inherited from decoded TIFF metadata. An attacker-controlled encode or decode-and-re-encode flow can write beyond the logical output span, corrupt process memory, and terminate the process. This issue is fixed in version 4.1.2.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 01:19 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/SixLabors/ImageSharp/security/… | x_refsource_CONFIRM |
| https://github.com/SixLabors/ImageSharp/pull/3187 | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/commit/a9… | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SixLabors | ImageSharp |
Affected:
>= 2.0.0, < 4.1.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106110",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T01:19:23.701254Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T01:19:50.868Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ImageSharp",
"vendor": "SixLabors",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c 4.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and T4BitCompressor.CompressStrip reaches unchecked writes when TiffCompression.CcittGroup3Fax is selected directly or inherited from decoded TIFF metadata. An attacker-controlled encode or decode-and-re-encode flow can write beyond the logical output span, corrupt process memory, and terminate the process. This issue is fixed in version 4.1.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:42:02.099Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q"
},
{
"name": "https://github.com/SixLabors/ImageSharp/pull/3187",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/pull/3187"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95"
},
{
"name": "https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"
}
],
"source": {
"advisory": "GHSA-j9gm-c75j-xc9q",
"discovery": "UNKNOWN"
},
"title": "ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106110",
"datePublished": "2026-10-06T17:42:02.099Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-09T01:19:50.868Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-54575 (GCVE-0-2025-54575)
Vulnerability from cvelistv5 – Published: 2025-07-30 19:55 – Updated: 2025-07-30 19:59
VLAI
EPSS
VEX
Title
ImageSharp Triggers an Infinite Loop in its GIF Decoder When Skipping Malformed Comment Extension Blocks
Summary
ImageSharp is a 2D graphics library. In versions below 2.1.11 and 3.0.0 through 3.1.10, a specially crafted GIF file containing a malformed comment extension block (with a missing block terminator) can cause the ImageSharp GIF decoder to enter an infinite loop while attempting to skip the block. This leads to a denial of service. Applications processing untrusted GIF input should upgrade to a patched version. This issue is fixed in versions 2.1.11 and 3.1.11.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-30 19:59 UTC
CWE
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/SixLabors/ImageSharp/security/… | x_refsource_CONFIRM |
| https://github.com/SixLabors/ImageSharp/issues/2953 | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/commit/55… | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/commit/83… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SixLabors | ImageSharp |
Affected:
< 2.1.11
Affected: >= 3.0.0, < 3.1.11 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-54575",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-30T19:59:26.928297Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-30T19:59:35.532Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ImageSharp",
"vendor": "SixLabors",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.11"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ImageSharp is a 2D graphics library. In versions below 2.1.11 and 3.0.0 through 3.1.10, a specially crafted GIF file containing a malformed comment extension block (with a missing block terminator) can cause the ImageSharp GIF decoder to enter an infinite loop while attempting to skip the block. This leads to a denial of service. Applications processing untrusted GIF input should upgrade to a patched version. This issue is fixed in versions 2.1.11 and 3.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-30T19:55:16.248Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-rxmq-m78w-7wmc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-rxmq-m78w-7wmc"
},
{
"name": "https://github.com/SixLabors/ImageSharp/issues/2953",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/issues/2953"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/55e49262df9a057dff9b7807ed1b7bdb49187c3f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/55e49262df9a057dff9b7807ed1b7bdb49187c3f"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/833f3ceec35af6b775950e06f03b934546cefbf6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/833f3ceec35af6b775950e06f03b934546cefbf6"
}
],
"source": {
"advisory": "GHSA-rxmq-m78w-7wmc",
"discovery": "UNKNOWN"
},
"title": "ImageSharp Triggers an Infinite Loop in its GIF Decoder When Skipping Malformed Comment Extension Blocks"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-54575",
"datePublished": "2025-07-30T19:55:16.248Z",
"dateReserved": "2025-07-25T16:19:16.092Z",
"dateUpdated": "2025-07-30T19:59:35.532Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-27598 (GCVE-0-2025-27598)
Vulnerability from cvelistv5 – Published: 2025-03-06 22:23 – Updated: 2025-03-07 19:41
VLAI
EPSS
VEX
Title
Out-of-bounds Write in SixLabors ImageSharp
Summary
ImageSharp is a 2D graphics API. An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service. The problem has been patched. All users are advised to upgrade to v3.1.7 or v2.1.10.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-07 19:41 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/SixLabors/ImageSharp/security/… | x_refsource_CONFIRM |
| https://github.com/SixLabors/ImageSharp/issues/2859 | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/pull/2890 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SixLabors | ImageSharp |
Affected:
< 2.1.10
Affected: >= 3.0.0, < 3.1.7 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-27598",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-07T19:41:27.595165Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-07T19:41:43.565Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/SixLabors/ImageSharp/issues/2859"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ImageSharp",
"vendor": "SixLabors",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.10"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.1.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ImageSharp is a 2D graphics API. An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service. The problem has been patched. All users are advised to upgrade to v3.1.7 or v2.1.10."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-06T22:23:39.486Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-2cmq-823j-5qj8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-2cmq-823j-5qj8"
},
{
"name": "https://github.com/SixLabors/ImageSharp/issues/2859",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/issues/2859"
},
{
"name": "https://github.com/SixLabors/ImageSharp/pull/2890",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/pull/2890"
}
],
"source": {
"advisory": "GHSA-2cmq-823j-5qj8",
"discovery": "UNKNOWN"
},
"title": "Out-of-bounds Write in SixLabors ImageSharp"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-27598",
"datePublished": "2025-03-06T22:23:39.486Z",
"dateReserved": "2025-03-03T15:10:34.078Z",
"dateUpdated": "2025-03-07T19:41:43.565Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-41132 (GCVE-0-2024-41132)
Vulnerability from cvelistv5 – Published: 2024-07-22 14:28 – Updated: 2024-08-02 04:46
VLAI
EPSS
VEX
Title
SixLabors ImageSharp Allows Excessive Memory Allocation in Gif Decoder
Summary
ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in the Gif decoder. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw. All users are advised to upgrade to v3.1.5 or v2.1.9.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-24 16:48 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
GitHub_M
CNA
References
9 references
| URL | Tags |
|---|---|
| https://github.com/SixLabors/ImageSharp/security/… | x_refsource_CONFIRM |
| https://github.com/SixLabors/ImageSharp/pull/2759 | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/pull/2764 | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/pull/2770 | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/commit/59… | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/commit/98… | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/commit/b4… | x_refsource_MISC |
| https://docs.sixlabors.com/articles/imagesharp.we… | x_refsource_MISC |
| https://docs.sixlabors.com/articles/imagesharp/se… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| SixLabors | ImageSharp |
Affected:
< 2.1.9
Affected: >= 3.0.0, < 3.1.5 |
|
| sixlabors | imagesharp |
Affected:
0 , < 2.1.9
(custom)
Affected: 3.0.0 , < 3.1.5 (custom) cpe:2.3:a:sixlabors:imagesharp:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:sixlabors:imagesharp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "imagesharp",
"vendor": "sixlabors",
"versions": [
{
"lessThan": "2.1.9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.5",
"status": "affected",
"version": "3.0.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41132",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-24T16:48:46.097607Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T16:49:43.578Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:46:52.026Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-qxrv-gp6x-rc23",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-qxrv-gp6x-rc23"
},
{
"name": "https://github.com/SixLabors/ImageSharp/pull/2759",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/SixLabors/ImageSharp/pull/2759"
},
{
"name": "https://github.com/SixLabors/ImageSharp/pull/2764",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/SixLabors/ImageSharp/pull/2764"
},
{
"name": "https://github.com/SixLabors/ImageSharp/pull/2770",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/SixLabors/ImageSharp/pull/2770"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/59de13c8cc47f2b402e2c43aa7024511d029d515",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/59de13c8cc47f2b402e2c43aa7024511d029d515"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/9816ca45016c5d3859986f3c600e8934bc450a56",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/9816ca45016c5d3859986f3c600e8934bc450a56"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/b496109051cc39feee1f6cde48fca6481de17f9a",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/b496109051cc39feee1f6cde48fca6481de17f9a"
},
{
"name": "https://docs.sixlabors.com/articles/imagesharp.web/processingcommands.html#securing-processing-commands",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.sixlabors.com/articles/imagesharp.web/processingcommands.html#securing-processing-commands"
},
{
"name": "https://docs.sixlabors.com/articles/imagesharp/security.html",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.sixlabors.com/articles/imagesharp/security.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ImageSharp",
"vendor": "SixLabors",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.9"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.1.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in the Gif decoder. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw. All users are advised to upgrade to v3.1.5 or v2.1.9."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-22T14:28:25.348Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-qxrv-gp6x-rc23",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-qxrv-gp6x-rc23"
},
{
"name": "https://github.com/SixLabors/ImageSharp/pull/2759",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/pull/2759"
},
{
"name": "https://github.com/SixLabors/ImageSharp/pull/2764",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/pull/2764"
},
{
"name": "https://github.com/SixLabors/ImageSharp/pull/2770",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/pull/2770"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/59de13c8cc47f2b402e2c43aa7024511d029d515",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/59de13c8cc47f2b402e2c43aa7024511d029d515"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/9816ca45016c5d3859986f3c600e8934bc450a56",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/9816ca45016c5d3859986f3c600e8934bc450a56"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/b496109051cc39feee1f6cde48fca6481de17f9a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/b496109051cc39feee1f6cde48fca6481de17f9a"
},
{
"name": "https://docs.sixlabors.com/articles/imagesharp.web/processingcommands.html#securing-processing-commands",
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.sixlabors.com/articles/imagesharp.web/processingcommands.html#securing-processing-commands"
},
{
"name": "https://docs.sixlabors.com/articles/imagesharp/security.html",
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.sixlabors.com/articles/imagesharp/security.html"
}
],
"source": {
"advisory": "GHSA-qxrv-gp6x-rc23",
"discovery": "UNKNOWN"
},
"title": "SixLabors ImageSharp Allows Excessive Memory Allocation in Gif Decoder"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-41132",
"datePublished": "2024-07-22T14:28:25.348Z",
"dateReserved": "2024-07-15T15:53:28.324Z",
"dateUpdated": "2024-08-02T04:46:52.026Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-41131 (GCVE-0-2024-41131)
Vulnerability from cvelistv5 – Published: 2024-07-22 14:24 – Updated: 2024-08-02 04:46
VLAI
EPSS
VEX
Title
Out-of-bounds Write in SixLabors ImageSharp
Summary
ImageSharp is a 2D graphics API. An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service. All users are advised to upgrade to v3.1.5 or v2.1.9.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-22 20:46 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
GitHub_M
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/SixLabors/ImageSharp/security/… | x_refsource_CONFIRM |
| https://github.com/SixLabors/ImageSharp/pull/2754 | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/pull/2756 | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/commit/9d… | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/commit/a1… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| SixLabors | ImageSharp |
Affected:
< 2.1.9
Affected: >= 3.0.0, < 3.1.5 |
|
| sixlabors | imagesharp |
Affected:
0 , < 2.1.9
(custom)
Affected: 3.0.0 , < 3.1.5 (custom) cpe:2.3:a:sixlabors:imagesharp:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:sixlabors:imagesharp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "imagesharp",
"vendor": "sixlabors",
"versions": [
{
"lessThan": "2.1.9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.5",
"status": "affected",
"version": "3.0.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41131",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-22T20:46:35.145007Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-22T20:46:58.460Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:46:52.374Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-63p8-c4ww-9cg7",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-63p8-c4ww-9cg7"
},
{
"name": "https://github.com/SixLabors/ImageSharp/pull/2754",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/SixLabors/ImageSharp/pull/2754"
},
{
"name": "https://github.com/SixLabors/ImageSharp/pull/2756",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/SixLabors/ImageSharp/pull/2756"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/9dda64a8186af67baf06b6d9c1ab599c3608b693",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/9dda64a8186af67baf06b6d9c1ab599c3608b693"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/a1f287977139109a987065643b8172c748abdadb",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/a1f287977139109a987065643b8172c748abdadb"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ImageSharp",
"vendor": "SixLabors",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.9"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.1.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ImageSharp is a 2D graphics API. An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service. All users are advised to upgrade to v3.1.5 or v2.1.9."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-22T14:24:42.461Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-63p8-c4ww-9cg7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-63p8-c4ww-9cg7"
},
{
"name": "https://github.com/SixLabors/ImageSharp/pull/2754",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/pull/2754"
},
{
"name": "https://github.com/SixLabors/ImageSharp/pull/2756",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/pull/2756"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/9dda64a8186af67baf06b6d9c1ab599c3608b693",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/9dda64a8186af67baf06b6d9c1ab599c3608b693"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/a1f287977139109a987065643b8172c748abdadb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/a1f287977139109a987065643b8172c748abdadb"
}
],
"source": {
"advisory": "GHSA-63p8-c4ww-9cg7",
"discovery": "UNKNOWN"
},
"title": "Out-of-bounds Write in SixLabors ImageSharp"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-41131",
"datePublished": "2024-07-22T14:24:42.461Z",
"dateReserved": "2024-07-15T15:53:28.324Z",
"dateUpdated": "2024-08-02T04:46:52.374Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-32036 (GCVE-0-2024-32036)
Vulnerability from cvelistv5 – Published: 2024-04-15 20:08 – Updated: 2024-08-02 02:06
VLAI
EPSS
VEX
Title
SixLabors.ImageSharp vulnerable to data leakage
Summary
ImageSharp is a 2D graphics API. A data leakage flaw was found in ImageSharp's JPEG and TGA decoders. This vulnerability is triggered when an attacker passes a specially crafted JPEG or TGA image file to a software using ImageSharp, potentially disclosing sensitive information from other parts of the software in the resulting image buffer. The problem has been patched in v3.1.4 and v2.1.8.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-23 19:48 UTC
CWE
- CWE-226 - Sensitive Information in Resource Not Removed Before Reuse
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/SixLabors/ImageSharp/security/… | x_refsource_CONFIRM |
| https://github.com/SixLabors/ImageSharp/commit/8f… | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/commit/da… | x_refsource_MISC |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| SixLabors | ImageSharp |
Affected:
< 2.1.8
Affected: >= 3.0.0, < 3.1.4 |
|
| sixlabors | imagesharp |
Affected:
0 , < 2.1.8
(semver)
cpe:2.3:a:sixlabors:imagesharp:-:*:*:*:*:*:*:* |
|
| sixlabors | imagesharp |
Affected:
3.0.0 , ≤ 3.1.4
(semver)
cpe:2.3:a:sixlabors:imagesharp:3.0.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:sixlabors:imagesharp:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "imagesharp",
"vendor": "sixlabors",
"versions": [
{
"lessThan": "2.1.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:sixlabors:imagesharp:3.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "imagesharp",
"vendor": "sixlabors",
"versions": [
{
"lessThanOrEqual": "3.1.4",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-32036",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-23T19:48:40.487832Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:50:18.733Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:06:42.826Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-5x7m-6737-26cr",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-5x7m-6737-26cr"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/8f0b4d3e680e78d479a88e7b1472bccd8f096d68",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/8f0b4d3e680e78d479a88e7b1472bccd8f096d68"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/da5f09a42513489fe359578d81cec2f15ba588ba",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/da5f09a42513489fe359578d81cec2f15ba588ba"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ImageSharp",
"vendor": "SixLabors",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.8"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.1.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ImageSharp is a 2D graphics API. A data leakage flaw was found in ImageSharp\u0027s JPEG and TGA decoders. This vulnerability is triggered when an attacker passes a specially crafted JPEG or TGA image file to a software using ImageSharp, potentially disclosing sensitive information from other parts of the software in the resulting image buffer. The problem has been patched in v3.1.4 and v2.1.8."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-226",
"description": "CWE-226: Sensitive Information in Resource Not Removed Before Reuse",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-16T22:58:38.425Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-5x7m-6737-26cr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-5x7m-6737-26cr"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/8f0b4d3e680e78d479a88e7b1472bccd8f096d68",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/8f0b4d3e680e78d479a88e7b1472bccd8f096d68"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/da5f09a42513489fe359578d81cec2f15ba588ba",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/da5f09a42513489fe359578d81cec2f15ba588ba"
}
],
"source": {
"advisory": "GHSA-5x7m-6737-26cr",
"discovery": "UNKNOWN"
},
"title": "SixLabors.ImageSharp vulnerable to data leakage"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-32036",
"datePublished": "2024-04-15T20:08:44.284Z",
"dateReserved": "2024-04-09T15:29:35.939Z",
"dateUpdated": "2024-08-02T02:06:42.826Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-32035 (GCVE-0-2024-32035)
Vulnerability from cvelistv5 – Published: 2024-04-15 19:59 – Updated: 2024-08-02 02:06
VLAI
EPSS
VEX
Title
Memory Allocation with Excessive Size Value in SixLabors.ImageSharp
Summary
ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in image decoders. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw. This flaw can be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on ImageSharp for image processing tasks. Users and administrators are advised to update to the latest version of ImageSharp that addresses this vulnerability to mitigate the risk of exploitation. The problem has been patched in v3.1.4 and v2.1.8.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-20 19:24 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
GitHub_M
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/SixLabors/ImageSharp/security/… | x_refsource_CONFIRM |
| https://github.com/SixLabors/ImageSharp/commit/b6… | x_refsource_MISC |
| https://github.com/SixLabors/ImageSharp/commit/f2… | x_refsource_MISC |
| https://docs.sixlabors.com/articles/imagesharp.we… | x_refsource_MISC |
| https://docs.sixlabors.com/articles/imagesharp/se… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| SixLabors | ImageSharp |
Affected:
< 2.1.8
Affected: >= 3.0.0, < 3.1.4 |
|
| sixlabors | imagesharp |
Affected:
3.0.0 , ≤ 3.1.4
(semver)
cpe:2.3:a:sixlabors:imagesharp:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:sixlabors:imagesharp:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "imagesharp",
"vendor": "sixlabors",
"versions": [
{
"lessThanOrEqual": "3.1.4",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-32035",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-20T19:24:51.431151Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:51:49.085Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:06:42.839Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-g85r-6x2q-45w7",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-g85r-6x2q-45w7"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/b6b08ac3e7cea8da5ac1e90f7c0b67dd254535c3",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/b6b08ac3e7cea8da5ac1e90f7c0b67dd254535c3"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/f21d64188e59ae9464ff462056a5e29d8e618b27",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/f21d64188e59ae9464ff462056a5e29d8e618b27"
},
{
"name": "https://docs.sixlabors.com/articles/imagesharp.web/processingcommands.html#securing-processing-commands",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.sixlabors.com/articles/imagesharp.web/processingcommands.html#securing-processing-commands"
},
{
"name": "https://docs.sixlabors.com/articles/imagesharp/security.html",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.sixlabors.com/articles/imagesharp/security.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ImageSharp",
"vendor": "SixLabors",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.8"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.1.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in image decoders. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw. This flaw can be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on ImageSharp for image processing tasks. Users and administrators are advised to update to the latest version of ImageSharp that addresses this vulnerability to mitigate the risk of exploitation. The problem has been patched in v3.1.4 and v2.1.8."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-15T19:59:59.530Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-g85r-6x2q-45w7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-g85r-6x2q-45w7"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/b6b08ac3e7cea8da5ac1e90f7c0b67dd254535c3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/b6b08ac3e7cea8da5ac1e90f7c0b67dd254535c3"
},
{
"name": "https://github.com/SixLabors/ImageSharp/commit/f21d64188e59ae9464ff462056a5e29d8e618b27",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SixLabors/ImageSharp/commit/f21d64188e59ae9464ff462056a5e29d8e618b27"
},
{
"name": "https://docs.sixlabors.com/articles/imagesharp.web/processingcommands.html#securing-processing-commands",
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.sixlabors.com/articles/imagesharp.web/processingcommands.html#securing-processing-commands"
},
{
"name": "https://docs.sixlabors.com/articles/imagesharp/security.html",
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.sixlabors.com/articles/imagesharp/security.html"
}
],
"source": {
"advisory": "GHSA-g85r-6x2q-45w7",
"discovery": "UNKNOWN"
},
"title": "Memory Allocation with Excessive Size Value in SixLabors.ImageSharp"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-32035",
"datePublished": "2024-04-15T19:59:59.530Z",
"dateReserved": "2024-04-09T15:29:35.939Z",
"dateUpdated": "2024-08-02T02:06:42.839Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27929 (GCVE-0-2024-27929)
Vulnerability from cvelistv5 – Published: 2024-03-05 16:30 – Updated: 2024-08-02 00:41
VLAI
EPSS
VEX
Title
Use After Free in SixLabors.ImageSharp
Summary
ImageSharp is a managed, cross-platform, 2D graphics library. A heap-use-after-free flaw was found in ImageSharp's InitializeImage() function of PngDecoderCore.cs file. This vulnerability is triggered when an attacker passes a specially crafted PNG image file to ImageSharp for conversion, potentially leading to information disclosure. This issue has been patched in versions 3.1.3 and 2.1.7.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-03-06 16:16 UTC
CWE
- CWE-416 - Use After Free
Assigner
GitHub_M
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/SixLabors/ImageSharp/security/… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SixLabors | ImageSharp |
Affected:
>= 3.0.0, < 3.1.3
Affected: < 2.1.7 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27929",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-06T16:16:14.955686Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-28T01:55:57.360Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:41:55.900Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-65x7-c272-7g7r",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-65x7-c272-7g7r"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ImageSharp",
"vendor": "SixLabors",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.1.3"
},
{
"status": "affected",
"version": "\u003c 2.1.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ImageSharp is a managed, cross-platform, 2D graphics library. A heap-use-after-free flaw was found in ImageSharp\u0027s InitializeImage() function of PngDecoderCore.cs file. This vulnerability is triggered when an attacker passes a specially crafted PNG image file to ImageSharp for conversion, potentially leading to information disclosure. This issue has been patched in versions 3.1.3 and 2.1.7."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-06T21:57:58.269Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-65x7-c272-7g7r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-65x7-c272-7g7r"
}
],
"source": {
"advisory": "GHSA-65x7-c272-7g7r",
"discovery": "UNKNOWN"
},
"title": "Use After Free in SixLabors.ImageSharp"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-27929",
"datePublished": "2024-03-05T16:30:35.795Z",
"dateReserved": "2024-02-28T15:14:14.215Z",
"dateUpdated": "2024-08-02T00:41:55.900Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}