{"id":"EUVD-2026-93560","enisaUuid":"ea108776-4506-3409-a561-d1f95ee740f2","description":"ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width. T4TiffCompression.WritePixelRun can accumulate oversized makeup-code runs, and ModifiedHuffmanTiffCompression.Decompress validates the width only after writing. The unchecked writes can overflow the strip buffer, corrupt heap memory, and terminate the process. This strip-path vulnerability is distinct from the tiled decompressor-width mismatch. This issue is fixed in version 4.1.1.","datePublished":"Oct 6, 2026, 5:53:46 PM","dateUpdated":"Oct 6, 2026, 6:20:09 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jj3q-cwqj-842r\nhttps://github.com/SixLabors/ImageSharp/pull/3176\nhttps://github.com/SixLabors/ImageSharp/commit/e8892ecd8a95dee95c4480fda51cfe0b32f3b846\nhttps://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1\n","aliases":"CVE-2026-106117\nGHSA-jj3q-cwqj-842r\n","assigner":"GitHub_M","epss":0.42,"enisaIdProduct":[{"id":"0e806b35-6e89-363f-aa1b-96559547df6e","product":{"name":"ImageSharp","vendor":{"name":"SixLabors"}},"product_version":"3.0.0, \u003c 4.1.1"}],"enisaIdVendor":[{"id":"d7c7f9d7-9cd3-3a9f-964a-7a59bf7f63d0","vendor":{"name":"SixLabors"}}],"enisaIdVulnerability":[{"id":"b0a4051d-7567-30a5-b61d-be3d34054398","vulnerability":{"id":"GHSA-jj3q-cwqj-842r","description":"ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp","datePublished":"Oct 7, 2026, 4:18:50 PM","dateUpdated":"Oct 12, 2026, 2:38:42 PM","baseScore":0.0,"references":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jj3q-cwqj-842r\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106117\nhttps://github.com/SixLabors/ImageSharp/pull/3176\nhttps://github.com/SixLabors/ImageSharp/commit/e8892ecd8a95dee95c4480fda51cfe0b32f3b846\nhttps://github.com/SixLabors/ImageSharp\nhttps://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0\nhttps://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1\n","enisa_id":"EUVD-2026-93560\n","aliases":"CVE-2026-106117\nGHSA-jj3q-cwqj-842r\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b404f919-b2d6-3610-8517-0256d52b2ee8","vulnerability":{"id":"CVE-2026-106117","description":"ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width. T4TiffCompression.WritePixelRun can accumulate oversized makeup-code runs, and ModifiedHuffmanTiffCompression.Decompress validates the width only after writing. The unchecked writes can overflow the strip buffer, corrupt heap memory, and terminate the process. This strip-path vulnerability is distinct from the tiled decompressor-width mismatch. This issue is fixed in version 4.1.1.","datePublished":"Oct 6, 2026, 5:53:46 PM","dateUpdated":"Oct 6, 2026, 6:20:09 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jj3q-cwqj-842r\nhttps://github.com/SixLabors/ImageSharp/pull/3176\nhttps://github.com/SixLabors/ImageSharp/commit/e8892ecd8a95dee95c4480fda51cfe0b32f3b846\nhttps://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1\n","enisa_id":"EUVD-2026-93560\n","assigner":"GitHub_M","epss":0.42,"dataProcessed":"Oct 27, 2026, 7:16:42 AM","vulnerabilityProduct":[{"id":"bfcc63f9-7e70-3dad-bca4-6734354b0847","product":{"name":"ImageSharp","vendor":{"name":"SixLabors"}},"product_version":"3.0.0, \u003c 4.1.1"}],"vulnerabilityVendor":[{"id":"c8e822ea-c5b7-3e16-b254-82503cb77670","vendor":{"name":"SixLabors"}}]}}],"enisaIdAdvisory":[]}