# CVE-2026-106114: SixLabors ImageSharp ICC CLUT buffer over-allocation

Source: https://junglewise.ai/threats/cve-2026-106114-imagesharp-is-a-2d-graphics-library-from-1-0-0-beta0001-until-4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-106114 · Severity: medium · CVSS 5.3 · Published 2026-10-06

ImageSharp is a .NET 2D graphics library used to process and transform images in applications. A malicious or corrupted image file can cause the library to allocate excessive memory when parsing ICC color profiles, potentially leading to denial of service through resource exhaustion. The vulnerability only affects applications that have enabled automatic color profile conversion; the default behavior is not vulnerable.

Technologies: [SixLabors.ImageSharp (NuGet)](https://junglewise.ai/threats/technologies/sixlabors-imagesharp), [SixLabors ImageSharp](https://junglewise.ai/threats/technologies/imagesharp). Vendors: [NuGet](https://junglewise.ai/threats/vendors/nuget), [SixLabors](https://junglewise.ai/threats/vendors/sixlabors).

## Quick answers

**Is CVE-2026-106114 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106114 being exploited in the wild.

**How severe is CVE-2026-106114?** Medium severity, with a CVSS score of 5.3, published 6 October 2026.

**Which products and versions are affected?** SixLabors.ImageSharp (NuGet) >= 1.0.0-beta0001, <= 4.1.1, ECOSYSTEM:introduced=1.0.0-beta0001,fixed=4.1.2; SixLabors ImageSharp 1.0.0-beta0001 to 4.1.1.

**Is there a fix for CVE-2026-106114?** Yes. SixLabors.ImageSharp (NuGet): upgrade to 4.1.2 or later. Until then: Do not enable automatic color profile conversion; keep DecoderOptions.ColorProfileHandling set to the default Preserve mode to avoid triggering the vulnerable parsing path. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106114 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-106114?** Check whether you run SixLabors.ImageSharp (NuGet) or SixLabors ImageSharp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- SixLabors.ImageSharp (NuGet): upgrade to 4.1.2 or later

  ```sh
  dotnet add package SixLabors.ImageSharp --version 4.1.2
  ```


Do not enable automatic color profile conversion; keep DecoderOptions.ColorProfileHandling set to the default Preserve mode to avoid triggering the vulnerable parsing path.

## Technical details

The ICC CLUT (Color Lookup Table) parser in IccDataReader.ReadClutF32 allocates memory based on attacker-controlled channel and grid dimension values before validating that the profile actually contains the declared data, allowing unbounded allocation from a truncated or malicious ICC profile. The vulnerability requires the application to have set DecoderOptions.ColorProfileHandling to Convert (the default Preserve mode is safe). This is an input-validation and resource-exhaustion issue rather than memory corruption or code execution.

## Affected products

- SixLabors ImageSharp 1.0.0-beta0001 to 4.1.1

## Identifiers

- CVE-2026-106114
- GHSA-gwg2-r3hj-4w44

## Timeline

- 2026-10-06: disclosed
- 2026-09-12: patched

## References

- [https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df](https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df)
- [https://github.com/SixLabors/ImageSharp/pull/3187](https://github.com/SixLabors/ImageSharp/pull/3187)

## Related threats

- [SixLabors ImageSharp TIFF heap overflow in tiled CCITT decompression](https://junglewise.ai/threats/cve-2026-106118-imagesharp-is-a-2d-graphics-library-from-3-0-0-until-4-1-1-tiled)
- [ImageSharp buffer overflow in CCITT TIFF decompression](https://junglewise.ai/threats/cve-2026-106117-imagesharp-is-a-2d-graphics-library-from-3-0-0-until-4-1-1)
- [SixLabors ImageSharp denial of service in EXIF BigTIFF parser](https://junglewise.ai/threats/cve-2026-106116-imagesharp-is-a-2d-graphics-library-from-2-0-0-until-4-1-2)
- [ImageSharp TIFF CCITT Group 4 encoder buffer overflow](https://junglewise.ai/threats/cve-2026-106115-imagesharp-is-a-2d-graphics-library-from-2-1-0-until-4-1-2-the)
- [ImageSharp out-of-range access in histogram equalization](https://junglewise.ai/threats/cve-2026-106113-imagesharp-is-a-2d-graphics-library-from-2-0-0-until-4-1-2)