CVE-2026-106112: ImageSharp ICC LUT16 conversion buffer overflow

CVE-2026-106112 · Severity: high · CVSS 7.5 · Published 2026-10-06

ImageSharp is a 2D graphics library used to process and manipulate images in .NET applications. When color profile conversion is enabled (DecoderOptions.ColorProfileHandling set to Convert), a malicious image with a crafted ICC profile can cause the library to write data beyond allocated memory buffers. This can corrupt the application's memory and crash the process, potentially providing a foothold for code execution attacks.

Technologies: SixLabors.ImageSharp (NuGet), SixLabors ImageSharp. Vendors: NuGet, SixLabors.

Quick answers

Is CVE-2026-106112 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-106112 being exploited in the wild.
How severe is CVE-2026-106112?
High severity, with a CVSS score of 7.5, published 6 October 2026.
Which products and versions are affected?
SixLabors.ImageSharp (NuGet) >= 4.0.0, <= 4.1.1, ECOSYSTEM:introduced=4.0.0,fixed=4.1.2; SixLabors ImageSharp 4.0.0 through 4.1.1.
Is there a fix for CVE-2026-106112?
Yes. SixLabors.ImageSharp (NuGet): upgrade to 4.1.2 or later. Until then: Disable ICC color profile conversion by setting DecoderOptions.ColorProfileHandling to Preserve (the default mode), which skips ICC conversion operations and prevents exploitation of this vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106112 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-106112?
Check whether you run SixLabors.ImageSharp (NuGet) or SixLabors ImageSharp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • SixLabors.ImageSharp (NuGet): upgrade to 4.1.2 or later
    dotnet add package SixLabors.ImageSharp --version 4.1.2

Disable ICC color profile conversion by setting DecoderOptions.ColorProfileHandling to Preserve (the default mode), which skips ICC conversion operations and prevents exploitation of this vulnerability.

Technical details

The vulnerability exists in ICC LUT16 (Lookup Table 16-bit) conversion logic within ClutCalculator and LutEntryCalculator, which store intermediate and output values in Vector4 (four floats). The code fails to validate that output channels do not exceed four, allowing malformed embedded ICC profiles to direct write operations beyond the four-float destination buffer. The attack requires enabling color profile conversion mode; the default Preserve mode is unaffected.

Affected products

  • SixLabors ImageSharp 4.0.0 through 4.1.1

Identifiers

  • CVE-2026-106112
  • GHSA-ffp7-56pq-64mr

Timeline

  • 2026-10-06: disclosed
  • 2026-09-05: patched: Fix committed to release/4.1.x branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.