[ Vendor · 9 CVEs ]
SixLabors
CVEs affecting SixLabors published in the last 30 days, plus any SixLabors CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-106118 | 6 Oct 2026 | CVSS 7.5 | ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB writeImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but… | Fix |
| CVE-2026-106114 | 6 Oct 2026 | CVSS 5.3 | ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensionsImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and… | Fix |
| CVE-2026-106115 | 6 Oct 2026 | CVSS 7.5 | ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output bufferImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though… | Fix |
| CVE-2026-106116 | 6 Oct 2026 | CVSS 5.3 | ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loopImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per… | Fix |
| CVE-2026-106117 | 6 Oct 2026 | CVSS 7.5 | ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharpImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass… | Fix |
| CVE-2026-106110 | 6 Oct 2026 | CVSS 7.5 | ImageSharp: TIFF CCITT T4 encoder can write past its compressed output bufferImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow… | Fix |
| CVE-2026-106111 | 6 Oct 2026 | CVSS 5.9 | ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflateImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result… | Fix |
| CVE-2026-106112 | 6 Oct 2026 | CVSS 7.5 | ImageSharp: ICC LUT16 output channel count can write beyond Vector4ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ICC LUT16 conversion accepts more than four output channels even though… | Fix |
| CVE-2026-106113 | 6 Oct 2026 | CVSS 7.5 | ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram indexImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and… | Fix |