{"id":"CVE-2026-106117","published":"2026-10-06T18:16:53.550","lastModified":"2026-10-06T20:03:40.690","description":"ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width. T4TiffCompression.WritePixelRun can accumulate oversized makeup-code runs, and ModifiedHuffmanTiffCompression.Decompress validates the width only after writing. The unchecked writes can overflow the strip buffer, corrupt heap memory, and terminate the process. This strip-path vulnerability is distinct from the tiled decompressor-width mismatch. This issue is fixed in version 4.1.1.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-787"],"vendors":[],"products":[],"references":[{"url":"https://github.com/SixLabors/ImageSharp/commit/e8892ecd8a95dee95c4480fda51cfe0b32f3b846","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/pull/3176","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jj3q-cwqj-842r","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jj3q-cwqj-842r","tags":[]}],"exploitRefs":[{"url":"https://github.com/SixLabors/ImageSharp/commit/e8892ecd8a95dee95c4480fda51cfe0b32f3b846","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/pull/3176","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jj3q-cwqj-842r","tags":[]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jj3q-cwqj-842r","tags":[]}],"hasPoc":true,"ai":{"summary":"ImageSharp library has a heap buffer overflow vulnerability in TIFF decoding when processing CCITT Group 3 or Modified Huffman compressed strips. An attacker can craft malicious TIFF files that cause oversized data writes to heap buffers, potentially leading to process termination or memory corruption.","exploitability":"Exploitation is moderately difficult as it requires crafting a specially crafted TIFF file with oversized compression runs, but the vulnerability is remotely triggerable through image processing workflows without user interaction.","blast_radius":"The impact is significant across any application using ImageSharp for TIFF image processing, particularly web applications that accept user-uploaded images or content management systems processing TIFF files.","remediation":"Upgrade to ImageSharp version 4.1.1 or later to fix the heap buffer overflow vulnerability in TIFF strip decompression.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["image-processing","heap-overflow","tiff"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:05:15.148Z"}}