Read the docs
TI-2026-68633 Aliases CVE-2026-106114GHSA-gwg2-r3hj-4w44

Excessive memory allocation in ImageSharp ICC CLUT parsing

Priority MEDIUM 63CWE-789Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-789.

Summary

ImageSharp versions from 1.0.0-beta0001 before 4.1.2 are affected. ICC CLUT parsing computes allocation sizes from channel and grid dimensions declared in a profile before checking that the profile contains them, so a short truncated profile can trigger a large allocation (CWE-789). An unauthenticated remote attacker can cause memory pressure with such input, and an exploit link appears in the references. The demonstrated impact is memory pressure and input validation failure; the issue does not cause process termination.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and earlier public IccProfile.Entries parsing paths can allocate a large jagged representation, from a short truncated profile. In version 4, automatic image conversion reaches the parser when DecoderOptions.ColorProfileHandling is Convert; the default Preserve mode avoids that conversion path. The demonstrated impact is memory pressure and input-validation failure, not unhandled process termination. This issue is fixed in version 4.1.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00328 26th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed ImageSharp (SixLabors): 4.1.2SixLabors.ImageSharp (NuGet): 4.1.2, 3.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SixLaborsImageSharp1.0.0-beta0001 to before 4.1.24.1.2Patch availableCNA
—SixLabors.ImageSharp (NuGet)4.0.0 to before 4.1.24.1.2Patch availableGHSA-gwg2-r3hj-4w44
—SixLabors.ImageSharp (NuGet)1.0.0-beta0001 to before 3.2.03.2.0Patch availableGHSA-gwg2-r3hj-4w44
  • ImageSharp VendorSixLabors Affected 1.0.0-beta0001 to before 4.1.2 Fixed in 4.1.2 Patch available CNA
  • SixLabors.ImageSharp (NuGet) Vendor— Affected 4.0.0 to before 4.1.2 Fixed in 4.1.2 Patch available GHSA-gwg2-r3hj-4w44
  • SixLabors.ImageSharp (NuGet) Vendor— Affected 1.0.0-beta0001 to before 3.2.0 Fixed in 3.2.0 Patch available GHSA-gwg2-r3hj-4w44

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sixlabors:imagesharp:*:*:*:*:*:*:*:*1.0.0 to before 3.2.0; 4.0.0 to before 4.1.2VulnerableSixLabors
  • cpe:2.3:a:sixlabors:imagesharp:*:*:*:*:*:*:*:* Versions 1.0.0 to before 3.2.0; 4.0.0 to before 4.1.2 Vulnerable ·SixLabors

Remediation

Upgrade SixLabors.ImageSharp to 4.1.2 in the 4.x line or to 3.2.0 in the 3.x line. In version 4, keep DecoderOptions.ColorProfileHandling at its default Preserve mode, which avoids the conversion path that reaches the parser.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA ImageSharp (SixLabors) Fixed in 4.1.2
  • Fix · GHSA-gwg2-r3hj-4w44 SixLabors.ImageSharp (NuGet) Fixed in 4.1.2 Advisory →
  • Fix · GHSA-gwg2-r3hj-4w44 SixLabors.ImageSharp (NuGet) Fixed in 3.2.0 Advisory →

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-106114
  2. 2026-10-07 CISA SSVC decision points changed
  3. 2026-10-07 Priority changed: LOW → MEDIUM
  4. 2026-10-07 Alias added: GHSA-gwg2-r3hj-4w44
  5. 2026-10-07 Fix available: NuGet/[email protected] · GHSA-gwg2-r3hj-4w44
  6. 2026-10-07 CVSS score added · GHSA-gwg2-r3hj-4w44
  7. 2026-10-07 Weakness changed · GHSA-gwg2-r3hj-4w44
  8. 2026-10-07 6 new references · GHSA-gwg2-r3hj-4w44

References

Exploit 1

Patch 2

Advisory 1

Other 5

  • TI-2026-68636 Out-of-bounds write in ImageSharp CCITT fax decompression CVSS 3.1HIGH 7.5
  • TI-2026-68634 Out-of-bounds write in ImageSharp TIFF CCITT Group 4 encoder CVSS 3.1HIGH 7.5
  • TI-2026-68629 Out-of-bounds write in ImageSharp TIFF CCITT encoder CVSS 3.1HIGH 7.5
  • TI-2025-20408 Out-of-bounds Write in SixLabors ImageSharp CVSS 3.1HIGH 7.5
  • TI-2026-68635 ImageSharp BigTIFF IFD count can keep a decoder thread in a non-progressing loop CVSS 3.1MEDIUM 5.3
  • TI-2026-68630 Stale buffer data disclosure in ImageSharp EXR ZIP decoding CVSS 3.1MEDIUM 5.9
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences