{"id":"CVE-2026-106115","published":"2026-10-06T18:16:53.250","lastModified":"2026-10-09T02:16:57.590","description":"ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked writes, and a decode-and-re-encode flow can inherit TiffCompression.CcittGroup4Fax and one-bit metadata from attacker-supplied input. The resulting out-of-bounds writes can corrupt memory and terminate the process. This issue is fixed in version 4.1.2.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-787"],"vendors":[],"products":[],"references":[{"url":"https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/pull/3187","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w","tags":[]}],"exploitRefs":[{"url":"https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/pull/3187","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w","tags":[]}],"hasPoc":true,"ai":{"summary":"ImageSharp's TIFF CCITT Group 4 encoder has a buffer overflow vulnerability that can lead to arbitrary code execution when processing specially crafted TIFF images. This occurs due to unchecked writes beyond allocated memory boundaries during compression.","exploitability":"Exploitation requires an attacker to provide a malicious TIFF image with specific metadata and compression settings, making it moderately difficult but possible to achieve remote code execution through a simple file upload or processing workflow.","blast_radius":"The vulnerability affects any application using ImageSharp's TIFF encoding functionality, particularly those processing untrusted TIFF files from web uploads, file transfers, or document processing pipelines, potentially leading to widespread service disruption or compromise.","remediation":"Upgrade to version 4.1.2 or later to remediate the buffer overflow in TIFF CCITT Group 4 encoding.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","image-processing","buffer-overflow"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:05:20.770Z"}}