CVE-2026-106113
Received Received - Intake

ImageSharp TIFF Decoding Heap Corruption via Unsafe Luminance

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: GitHub, Inc.

Description
ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process termination. Adaptive Histogram Equalization and AutoLevel are not affected by this report. This issue is fixed in version 4.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-106113
EUVD
EUVD-2026-93554

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SixLabors ImageSharp >= 2.0.0, < 4.1.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects ImageSharp, a 2D graphics library. When decoding a malicious 32-bit floating-point TIFF image as a specific format and applying HistogramEqualization, it can produce invalid luminance values. These values are then used unsafely as histogram offsets, leading to out-of-range memory access and causing the application to crash.

Detection Guidance

Detection requires checking if ImageSharp versions between 2.0.0 and 4.1.2 are in use. Inspect project dependencies for ImageSharp packages and verify version numbers. No specific commands are provided in the context.

Impact Analysis

If exploited, this flaw could allow an attacker to crash your application by providing a specially crafted image file. This may lead to denial-of-service conditions, disrupting services that rely on ImageSharp for image processing.

Compliance Impact

This vulnerability causes process termination due to unsafe memory access, which could lead to denial-of-service conditions in applications handling sensitive data. For GDPR, this may impact availability of systems processing personal data. For HIPAA, it could disrupt healthcare applications managing protected health information by causing unexpected failures.

Mitigation Strategies

Upgrade ImageSharp to version 4.1.2 or later immediately. Remove or disable any affected TIFF processing workflows until the update is applied. Monitor systems for crashes or unexpected behavior during image processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106113. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart