{"id":"CVE-2026-106110","published":"2026-10-06T18:16:52.490","lastModified":"2026-10-09T02:16:57.433","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and T4BitCompressor.CompressStrip reaches unchecked writes when TiffCompression.CcittGroup3Fax is selected directly or inherited from decoded TIFF metadata. An attacker-controlled encode or decode-and-re-encode flow can write beyond the logical output span, corrupt process memory, and terminate the process. This issue is fixed in version 4.1.2.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-787"],"vendors":[],"products":[],"references":[{"url":"https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/pull/3187","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q","tags":[]}],"exploitRefs":[{"url":"https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/pull/3187","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q","tags":[]}],"hasPoc":true,"ai":{"summary":"ImageSharp's TIFF CCITT Group 3 encoder has a buffer overflow vulnerability that can lead to arbitrary code execution when processing narrow 1-bit images. This affects versions 2.0.0 through 4.1.2 and allows attackers to corrupt memory and terminate processes.","exploitability":"Exploitation is moderately difficult as it requires an attacker to control the encoding of a narrow 1-bit TIFF image, either directly or through a decode-encode cycle, with specific TiffCompression.CcittGroup3Fax settings.","blast_radius":"The impact is significant for applications that process TIFF images, particularly those handling user-uploaded or third-party images, as it can lead to service disruption and potential remote code execution on affected systems.","remediation":"Upgrade to ImageSharp version 4.1.2 or later to remediate the buffer overflow vulnerability in the TIFF CCITT Group 3 encoder.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","image-processing","memory-corruption"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:05:38.163Z"}}