cyfenced.com →

[ CVE-2026-106111 · Published 6 Oct 2026 ]

ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate

CVSS 5.9 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR block's required size. ZipExrCompression.Decompress reconstructs the returned prefix while ExrDecoderCore processes the full expected block from a buffer obtained through Configuration.Default, allowing bytes retained from a completed prior ImageSharp operation to appear in decoded pixels. Applications that expose pixels or output from the later attacker-controlled EXR decode can disclose process-local image data. This issue is fixed in version 4.1.2.

[ Fixes ]Fixes and patches

  • SixLabors.ImageSharp 4.1.2Fixed version · GitHub Advisories · nuget package SixLabors.ImageSharp: upgrade to 4.1.2 or later (affected >= 4.0.0, <= 4.1.1)

[ Packages ]Affected open-source packages

  • SixLabors.ImageSharp nugetAffected >= 4.0.0, <= 4.1.1 · fixed in 4.1.2 · GHSA-4q3p-rj5x-xv7p

[ References ]References