CVE-2026-106110
An attacker-controlled encode or decode-and-re-encode flow can write beyond the logical output span, corrupt process memory, and terminate the process.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.39%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and T4BitCompressor.CompressStrip reaches unchecked writes when TiffCompression.CcittGroup3Fax is selected directly or inherited from decoded TIFF metadata. An attacker-controlled encode or decode-and-re-encode flow can write beyond the logical output span, corrupt process memory, and terminate the process. This issue is fixed in version 4.1.2.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.39% probability · 32th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-787
- Affected
- sixlabors/imagesharp
- Source
- security-advisories@github.com
EPSS moved from 0.4% on 7 October 2026 to 0.4% on 26 October 2026.
References
- https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95Patch
- https://github.com/SixLabors/ImageSharp/pull/3187Issue Tracking, Patch
- https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2Release Notes
- https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9qExploit, Vendor Advisory
- https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9qExploit, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.