cyfenced.com →

[ CVE-2026-106114 · Published 6 Oct 2026 ]

ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions

CVSS 5.3 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and earlier public IccProfile.Entries parsing paths can allocate a large jagged representation, from a short truncated profile. In version 4, automatic image conversion reaches the parser when DecoderOptions.ColorProfileHandling is Convert; the default Preserve mode avoids that conversion path. The demonstrated impact is memory pressure and input-validation failure, not unhandled process termination. This issue is fixed in version 4.1.2.

[ Fixes ]Fixes and patches

  • SixLabors.ImageSharp 4.1.2Fixed version · GitHub Advisories · nuget package SixLabors.ImageSharp: upgrade to 4.1.2 or later (affected >= 1.0.0-beta0001, <= 4.1.1)

[ Packages ]Affected open-source packages

  • SixLabors.ImageSharp nugetAffected >= 1.0.0-beta0001, <= 4.1.1 · fixed in 4.1.2 · GHSA-gwg2-r3hj-4w44

[ References ]References