{"id":"EUVD-2026-93560","revision":"b2d632c7eca249ed82410651936b7d69","records":[{"revision":"b2d632c7eca249ed82410651936b7d69","observedAt":"2026-10-28T00:49:10.297+00:00","statement":{"source":"euvd","id":"EUVD-2026-93560","aliases":["CVE-2026-106117","GHSA-jj3q-cwqj-842r"],"title":"ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width.…","description":"ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width. T4TiffCompression.WritePixelRun can accumulate oversized makeup-code runs, and ModifiedHuffmanTiffCompression.Decompress validates the width only after writing. The unchecked writes can overflow the strip buffer, corrupt heap memory, and terminate the process. This strip-path vulnerability is distinct from the tiled decompressor-width mismatch. This issue is fixed in version 4.1.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jj3q-cwqj-842r","https://github.com/SixLabors/ImageSharp/pull/3176","https://github.com/SixLabors/ImageSharp/commit/e8892ecd8a95dee95c4480fda51cfe0b32f3b846","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-93560","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 6, 2026, 5:53:46 PM","dateUpdated":"Oct 6, 2026, 6:20:09 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-93560","identifiers":["EUVD-2026-93560","CVE-2026-106117","GHSA-jj3q-cwqj-842r"]},"retained":false,"historicalAffected":[]}],"coverage":[]}