Quick answers
- Is CVE-2026-106117 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-106117 being exploited in the wild.
- How severe is CVE-2026-106117?
- High severity, with a CVSS score of 7.5, published 6 October 2026.
- Which products and versions are affected?
- ImageSharp (NuGet) >= 3.0.0, < 4.1.1, ECOSYSTEM:introduced=3.0.0,fixed=4.1.1; SixLabors ImageSharp 3.0.0 to 4.1.0.
- Is there a fix for CVE-2026-106117?
- Yes. ImageSharp (NuGet): upgrade to 4.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-106117 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-106117?
- Check whether you run ImageSharp (NuGet) or SixLabors ImageSharp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- ImageSharp (NuGet): upgrade to 4.1.1 or later
dotnet add package ImageSharp --version 4.1.1
Technical details
A buffer overflow exists in the CCITT Group 3 and Modified Huffman TIFF decompressors (T4TiffCompression and ModifiedHuffmanTiffCompression) where pixel runs are written without first validating they fit within the current row width, causing out-of-bounds writes to the strip buffer. The vulnerability affects strip-based TIFF images where attacker-controlled compression data can trigger oversized makeup-code runs. An attacker can craft a malicious TIFF file that, when decoded by a vulnerable application, causes heap corruption or denial of service.
Affected products
- SixLabors ImageSharp 3.0.0 to 4.1.0
Identifiers
- CVE-2026-106117
- GHSA-jj3q-cwqj-842r
Timeline
- 2026-10-06: disclosed
- 2026-08-20: patched