TI-2025-34352 Aliases CVE-2025-54575 GHSA-rxmq-m78w-7wmc

ImageSharp Triggers an Infinite Loop in its GIF Decoder When Skipping Malformed Comment Extension Blocks

MEDIUM 63CWE-400Published 2025-07-30 · Updated 2025-07-30

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

ImageSharp is a 2D graphics library. In versions below 2.1.11 and 3.0.0 through 3.1.10, a specially crafted GIF file containing a malformed comment extension block (with a missing block terminator) can cause the ImageSharp GIF decoder to enter an infinite loop while attempting to skip the block. This leads to a denial of service. Applications processing untrusted GIF input should upgrade to a patched version. This issue is fixed in versions 2.1.11 and 3.1.11.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00449 39th percentileScored 2026-11-07

Fix Fixed ImageSharp (SixLabors): 2.1.11, 3.1.11SixLabors.ImageSharp (NuGet): 2.1.11, 3.1.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SixLabors	ImageSharp	before 2.1.11; 3.0.0 to before 3.1.11	2.1.11, 3.1.11	Patch available	CNA
—	SixLabors.ImageSharp (NuGet)	before 2.1.11	2.1.11	Patch available	GHSA-rxmq-m78w-7wmc
—	SixLabors.ImageSharp (NuGet)	3.0.0 to before 3.1.11	3.1.11	Patch available	GHSA-rxmq-m78w-7wmc

ImageSharp VendorSixLabors Affected before 2.1.11; 3.0.0 to before 3.1.11 Fixed in 2.1.11, 3.1.11 Patch available CNA
SixLabors.ImageSharp (NuGet) Vendor— Affected before 2.1.11 Fixed in 2.1.11 Patch available GHSA-rxmq-m78w-7wmc
SixLabors.ImageSharp (NuGet) Vendor— Affected 3.0.0 to before 3.1.11 Fixed in 3.1.11 Patch available GHSA-rxmq-m78w-7wmc

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:sixlabors:imagesharp::::::::	—	—	SixLabors

cpe:2.3:a:sixlabors:imagesharp:*:*:*:*:*:*:*:* Versions — — ·SixLabors

Remediation

Fix · CNA ImageSharp (SixLabors) Fixed in 2.1.11, 3.1.11
Fix · GHSA-rxmq-m78w-7wmc SixLabors.ImageSharp (NuGet) Fixed in 2.1.11 Advisory →
Fix · GHSA-rxmq-m78w-7wmc SixLabors.ImageSharp (NuGet) Fixed in 3.1.11 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-54575
2026-10-03 Alias added: GHSA-rxmq-m78w-7wmc

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-54575

Other 5

TI-2026-68636 Out-of-bounds write in ImageSharp CCITT fax decompression CVSS 3.1HIGH 7.5
TI-2026-68634 Out-of-bounds write in ImageSharp TIFF CCITT Group 4 encoder CVSS 3.1HIGH 7.5
TI-2026-68629 Out-of-bounds write in ImageSharp TIFF CCITT encoder CVSS 3.1HIGH 7.5
TI-2025-20408 Out-of-bounds Write in SixLabors ImageSharp CVSS 3.1HIGH 7.5
TI-2026-68635 ImageSharp BigTIFF IFD count can keep a decoder thread in a non-progressing loop CVSS 3.1MEDIUM 5.3
TI-2026-68633 Excessive memory allocation in ImageSharp ICC CLUT parsing CVSS 3.1MEDIUM 5.3

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences