CVE-2026-106117: Sixlabors Imagesharp

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width. T4TiffCompression.WritePixelRun can accumulate oversized makeup-code runs, and ModifiedHuffmanTiffCompression.Decompress validates the width only after writing. The unchecked writes can overflow the strip buffer, corrupt heap memory, and terminate the process. This strip-path vulnerability is distinct from the tiled decompressor-width mismatch. This issue is fixed in version 4.1.1.

Affected products

• Sixlabors Imagesharp: from 3.0.0, before 4.1.1 (fixed in 4.1.1)

Published 2026-10-06. Last modified 2026-10-06.