CVE-2026-106115: ImageSharp TIFF CCITT Group 4 encoder buffer overflow

CVE-2026-106115 · Severity: high · CVSS 7.5 · Published 2026-10-06

ImageSharp is a graphics library used to process and manipulate digital images. A flaw in the TIFF CCITT Group 4 compression encoder can write beyond allocated memory when re-encoding maliciously crafted image files, causing the application to crash or potentially allowing an attacker to corrupt memory. An attacker could exploit this by providing a specially crafted TIFF image.

Technologies: SixLabors.ImageSharp (NuGet), SixLabors ImageSharp. Vendors: NuGet, SixLabors.

Quick answers

Is CVE-2026-106115 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-106115 being exploited in the wild.
How severe is CVE-2026-106115?
High severity, with a CVSS score of 7.5, published 6 October 2026.
Which products and versions are affected?
SixLabors.ImageSharp (NuGet) >= 2.1.0, <= 4.1.1, ECOSYSTEM:introduced=2.1.0,fixed=4.1.2; SixLabors ImageSharp 2.1.0 to 4.1.1.
Is there a fix for CVE-2026-106115?
Yes. SixLabors.ImageSharp (NuGet): upgrade to 4.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106115 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-106115?
Check whether you run SixLabors.ImageSharp (NuGet) or SixLabors ImageSharp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • SixLabors.ImageSharp (NuGet): upgrade to 4.1.2 or later
    dotnet add package SixLabors.ImageSharp --version 4.1.2

Technical details

The TIFF CCITT Group 4 encoder in ImageSharp allocates Width × rowsPerStrip bytes, but the T6BitCompressor.CompressStrip method can emit encoded data exceeding this capacity, including two 12-bit end-of-facsimile-block codes. TiffCcittCompressor.WriteCode performs unchecked writes, resulting in out-of-bounds memory writes. A decode-and-re-encode flow can inherit CCITT Group 4 compression settings from attacker-supplied TIFF input, triggering the vulnerability.

Affected products

  • SixLabors ImageSharp 2.1.0 to 4.1.1

Identifiers

  • CVE-2026-106115
  • GHSA-jjfr-hcj7-qf5w

Timeline

  • 2026-10-06: disclosed
  • 2026-09-12: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.