CVE-2026-106111
Received Received - Intake

Memory Corruption in ImageSharp Library

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: GitHub, Inc.

Description
ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR block's required size. ZipExrCompression.Decompress reconstructs the returned prefix while ExrDecoderCore processes the full expected block from a buffer obtained through Configuration.Default, allowing bytes retained from a completed prior ImageSharp operation to appear in decoded pixels. Applications that expose pixels or output from the later attacker-controlled EXR decode can disclose process-local image data. This issue is fixed in version 4.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-106111
EUVD
EUVD-2026-93576

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SixLabors ImageSharp >= 4.0.0, < 4.1.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-226 The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ImageSharp versions 4.0.0 to 4.1.2 contain a flaw in ExrBaseDecompressor.UndoZipCompression where a ZIP or ZIPS inflate result shorter than required is accepted. This allows retained bytes from prior operations to appear in decoded pixels, potentially exposing process-local image data.

Detection Guidance

This vulnerability affects ImageSharp versions 4.0.0 to 4.1.2. To detect it, check the installed version of ImageSharp in your project dependencies. If using .NET, run 'dotnet list package' to list all packages and versions. If the version is between 4.0.0 and 4.1.2, the system is vulnerable.

Impact Analysis

If you use ImageSharp to process EXR images, an attacker could craft a malicious EXR file that leaks memory contents from your application when decoded. This could expose sensitive data like internal images or other process memory.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's safeguards for protected health information if sensitive data is leaked through image processing.

Mitigation Strategies

Upgrade ImageSharp to version 4.1.2 or later immediately. If using NuGet, run 'dotnet add package SixLabors.ImageSharp --version 4.1.2' to update. Review applications that process EXR files to ensure no sensitive data exposure occurred before the update.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106111. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart