Is CVE-2026-106114 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106114 being exploited in the wild.

How severe is CVE-2026-106114?

Medium severity, with a CVSS score of 5.3, published 6 October 2026.

Which products and versions are affected?

SixLabors.ImageSharp (NuGet) >= 1.0.0-beta0001, <= 4.1.1, ECOSYSTEM:introduced=1.0.0-beta0001,fixed=4.1.2; SixLabors ImageSharp 1.0.0-beta0001 to 4.1.1.

How is CVE-2026-106114 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-106114?

Check whether you run SixLabors.ImageSharp (NuGet) or SixLabors ImageSharp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106114: SixLabors ImageSharp ICC CLUT buffer over-allocation

Q: Is there a fix for CVE-2026-106114?

Yes. SixLabors.ImageSharp (NuGet): upgrade to 4.1.2 or later. Until then: Do not enable automatic color profile conversion; keep DecoderOptions.ColorProfileHandling set to the default Preserve mode to avoid triggering the vulnerable parsing path. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-106114 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-106114?

Check whether you run SixLabors.ImageSharp (NuGet) or SixLabors ImageSharp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106114 · Severity: medium · CVSS 5.3 · Published 2026-10-06

ImageSharp is a .NET 2D graphics library used to process and transform images in applications. A malicious or corrupted image file can cause the library to allocate excessive memory when parsing ICC color profiles, potentially leading to denial of service through resource exhaustion. The vulnerability only affects applications that have enabled automatic color profile conversion; the default behavior is not vulnerable.

Technologies: SixLabors.ImageSharp (NuGet), SixLabors ImageSharp. Vendors: NuGet, SixLabors.

Quick answers

Is CVE-2026-106114 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106114 being exploited in the wild.
How severe is CVE-2026-106114?: Medium severity, with a CVSS score of 5.3, published 6 October 2026.
Which products and versions are affected?: SixLabors.ImageSharp (NuGet) >= 1.0.0-beta0001, <= 4.1.1, ECOSYSTEM:introduced=1.0.0-beta0001,fixed=4.1.2; SixLabors ImageSharp 1.0.0-beta0001 to 4.1.1.
Is there a fix for CVE-2026-106114?: Yes. SixLabors.ImageSharp (NuGet): upgrade to 4.1.2 or later. Until then: Do not enable automatic color profile conversion; keep DecoderOptions.ColorProfileHandling set to the default Preserve mode to avoid triggering the vulnerable parsing path. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106114 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-106114?: Check whether you run SixLabors.ImageSharp (NuGet) or SixLabors ImageSharp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

SixLabors.ImageSharp (NuGet): upgrade to 4.1.2 or later

dotnet add package SixLabors.ImageSharp --version 4.1.2

Do not enable automatic color profile conversion; keep DecoderOptions.ColorProfileHandling set to the default Preserve mode to avoid triggering the vulnerable parsing path.

Technical details

The ICC CLUT (Color Lookup Table) parser in IccDataReader.ReadClutF32 allocates memory based on attacker-controlled channel and grid dimension values before validating that the profile actually contains the declared data, allowing unbounded allocation from a truncated or malicious ICC profile. The vulnerability requires the application to have set DecoderOptions.ColorProfileHandling to Convert (the default Preserve mode is safe). This is an input-validation and resource-exhaustion issue rather than memory corruption or code execution.

Affected products

SixLabors ImageSharp 1.0.0-beta0001 to 4.1.1

Identifiers

CVE-2026-106114
GHSA-gwg2-r3hj-4w44

Timeline

2026-10-06: disclosed
2026-09-12: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.