Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-106111 · GHSA-4q3p-rj5x-xv7p

ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate

Risk score
46/100
CVSS
5.3 v3.1
Exploit chance (30 days)
0.3%
Published
6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR block's required size. ZipExrCompression.Decompress reconstructs the returned prefix while ExrDecoderCore processes the full expected block from…
Affected
SixLabors.ImageSharp (nuget) >= 4.0.0, <= 4.1.1
Fix
Upgrade SixLabors.ImageSharp to 4.1.2 or later.
Exploitation
Public proof of concept

Story map

Story map: SixLabors.ImageSharpTHE FLAWSTHE FIXCVE-2026-106111ImageSharp: EXR ZIP decodercan expose stale allocator dataafter a short inflateCVSS 5.3 · EPSS 0%CVE-2026-106115ImageSharp: TIFF CCITT T6encoder writes beyond anundersized output bufferCVSS 7.5 · EPSS 0%CVE-2026-106112ImageSharp: ICC LUT16 outputchannel count can write beyondVector4CVSS 7.5 · EPSS 0%CVE-2026-106110ImageSharp: TIFF CCITT T4encoder can write past itscompressed output bufferCVSS 7.5 · EPSS 0%Upgrade…4.1.2or later on your release lineWho is exposedSixLabors.ImageSharp (nuget)>= 2.1.0, <= 4.1.1AMBER · PATCH THIS WEEKSixLabors.ImageSharpImageSharp is a 2D graphicslibrary. From 2.1.0 until 4.1.2,the TIFF CCITT Group 4encoder allocates Width timesrowsPerStrip bytes even thoughT6BitCompressor.CompressStrip can emit encoded row data…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-226 (CWE-226)3 other warnings in 30 days →Same productEarlier SixLabors.ImageSharp warnings3 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

SixLabors.ImageSharp: Amber, patch this week. ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked wri…

The flaws

  • CVE-2026-106111: ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate (CVSS 5.3 · EPSS 0%)
  • CVE-2026-106115: ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer (CVSS 7.5 · EPSS 0%)
  • CVE-2026-106112: ImageSharp: ICC LUT16 output channel count can write beyond Vector4 (CVSS 7.5 · EPSS 0%)
  • CVE-2026-106110: ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer (CVSS 7.5 · EPSS 0%)

The fix

Upgrade SixLabors.ImageSharp: 4.1.2 or later on your release line

Who is exposed: SixLabors.ImageSharp (nuget) >= 2.1.0, <= 4.1.1

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 5.3 medium
  • Public exploit or proof of concept referenced
  • On your watchlist: NuGet

Affected packages

PackageEcosystemVulnerableFixed in
SixLabors.ImageSharpnuget>= 4.0.0, <= 4.1.14.1.2

References

Original description

ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR block's required size. ZipExrCompression.Decompress reconstructs the returned prefix while ExrDecoderCore processes the full expected block from a buffer obtained through Configuration.Default, allowing bytes retained from a completed prior ImageSharp operation to appear in decoded pixels. Applications that expose pixels or output from the later attacker-controlled EXR decode can disclose process-local image data. This issue is fixed in version 4.1.2.

Last activity 6 Oct 2026. Patch Forecast updates every hour.