Patch Forecast
Amber warning
Patch this week.

CVE-2026-106112 · GHSA-ffp7-56pq-64mr

ImageSharp: ICC LUT16 output channel count can write beyond Vector4

Risk score
66/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.4%
Published
6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ICC LUT16 conversion accepts more than four output channels even though ClutCalculator.Calculate and LutEntryCalculator.CalculateLut store intermediate and output values in Vector4. When DecoderOptions.ColorProfileHandling is set to Convert, a malformed embe…
Affected
SixLabors.ImageSharp (nuget) >= 4.0.0, <= 4.1.1
Fix
Upgrade SixLabors.ImageSharp to 4.1.2 or later.
Exploitation
Public proof of concept

Story map

Story map: SixLabors.ImageSharpTHE FLAWSTHE FIXCVE-2026-106112ImageSharp: ICC LUT16 outputchannel count can write beyondVector4CVSS 7.5 · EPSS 0%CVE-2026-106115ImageSharp: TIFF CCITT T6encoder writes beyond anundersized output bufferCVSS 7.5 · EPSS 0%CVE-2026-106110ImageSharp: TIFF CCITT T4encoder can write past itscompressed output bufferCVSS 7.5 · EPSS 0%CVE-2026-106113ImageSharp:HistogramEqualization uses anunvalidated luminance as an…CVSS 7.5 · EPSS 0%Upgrade…4.1.2or later on your release lineWho is exposedSixLabors.ImageSharp (nuget)>= 4.0.0, <= 4.1.1AMBER · PATCH THIS WEEKSixLabors.ImageSharpImageSharp is a 2D graphicslibrary. From 4.0.0 until 4.1.2,ICC LUT16 conversion acceptsmore than four output channelseven thoughClutCalculator.Calculate andLutEntryCalculator.CalculateL…Where it standsPublic proof of conceptCONNECTS TOSame weaknessOut-of-bounds write (CWE-787)258 other warnings in 30 days →Same productEarlier SixLabors.ImageSharp warnings3 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

SixLabors.ImageSharp: Amber, patch this week. ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ICC LUT16 conversion accepts more than four output channels even though ClutCalculator.Calculate and LutEntryCalculator.CalculateLut store intermediate and output values in Vector4. When DecoderOptions.ColorProfileHandling is set to Convert, a malformed embe…

The flaws

  • CVE-2026-106112: ImageSharp: ICC LUT16 output channel count can write beyond Vector4 (CVSS 7.5 · EPSS 0%)
  • CVE-2026-106115: ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer (CVSS 7.5 · EPSS 0%)
  • CVE-2026-106110: ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer (CVSS 7.5 · EPSS 0%)
  • CVE-2026-106113: ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index (CVSS 7.5 · EPSS 0%)

The fix

Upgrade SixLabors.ImageSharp: 4.1.2 or later on your release line

Who is exposed: SixLabors.ImageSharp (nuget) >= 4.0.0, <= 4.1.1

Where it stands

  • Public proof of concept

Connects to

Why it is Amber

  • CVSS 7.5 high
  • Public exploit or proof of concept referenced
  • Remotely exploitable without logging in
  • On your watchlist: NuGet

Affected packages

PackageEcosystemVulnerableFixed in
SixLabors.ImageSharpnuget>= 4.0.0, <= 4.1.14.1.2

References

Original description

ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ICC LUT16 conversion accepts more than four output channels even though ClutCalculator.Calculate and LutEntryCalculator.CalculateLut store intermediate and output values in Vector4. When DecoderOptions.ColorProfileHandling is set to Convert, a malformed embedded profile can direct interpolation and output-LUT operations to write one float per declared channel beyond the four-float destination. This can corrupt memory and terminate the process; the default Preserve mode does not run ICC conversion. This issue is fixed in version 4.1.2.

Last activity 6 Oct 2026. Patch Forecast updates every hour.