CVE-2026-106117 · GHSA-jj3q-cwqj-842r
ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp
- Risk score
- 62/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 6 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width. T4TiffCompression.WritePixelRun can accumulate oversized makeup-code runs, and…
- Affected
- ImageSharp (nuget) >= 3.0.0, < 3.2.0; ImageSharp (nuget) >= 4.0.0, < 4.1.1
- Fix
- Upgrade ImageSharp to 3.2.0 or 4.1.1 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
ImageSharp: Amber, patch this week. ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constructs T4, T6, and Modified Huffman decompressors using the full frame width. TiffDecoderCore.DecodeTilesChunky can therefore direct frame-width fax sc…
The flaws
- CVE-2026-106117: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp (CVSS 7.5 · EPSS 0%)
- CVE-2026-106118: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write (CVSS 7.5 · EPSS 1%)
The fix
Upgrade ImageSharp: 4.1.1 or later on your release line
Who is exposed: ImageSharp (nuget) >= 3.0.0, < 4.1.1
Where it stands
- No known exploitation
Connects to
- Same weakness: Out-of-bounds write (CWE-787). 257 other warnings in 30 days
Why it is Amber
- CVSS 7.5 high
- Remotely exploitable without logging in
- On your watchlist: NuGet
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| ImageSharp | nuget | >= 3.0.0, < 3.2.0 | 3.2.0 |
| ImageSharp | nuget | >= 4.0.0, < 4.1.1 | 4.1.1 |
References
- https://github.com/advisories/GHSA-jj3q-cwqj-842r
- https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jj3q-cwqj-842r
- https://nvd.nist.gov/vuln/detail/CVE-2026-106117
- https://github.com/SixLabors/ImageSharp/pull/3176
- https://github.com/SixLabors/ImageSharp/commit/e8892ecd8a95dee95c4480fda51cfe0b32f3b846
- https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1
- https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0
- https://github.com/advisories/GHSA-jj3q-cwqj-842r
Original description
ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width. T4TiffCompression.WritePixelRun can accumulate oversized makeup-code runs, and ModifiedHuffmanTiffCompression.Decompress validates the width only after writing. The unchecked writes can overflow the strip buffer, corrupt heap memory, and terminate the process. This strip-path vulnerability is distinct from the tiled decompressor-width mismatch. This issue is fixed in version 4.1.1.
Last activity 6 Oct 2026. Patch Forecast updates every hour.