{"id":"EUVD-2026-93770","enisaUuid":"37d3044d-ca9b-304e-8dcb-e8edc9fbb40a","description":"ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constructs T4, T6, and Modified Huffman decompressors using the full frame width. TiffDecoderCore.DecodeTilesChunky can therefore direct frame-width fax scanlines into a tile-width buffer when TileWidth is smaller than ImageWidth. The mismatch causes attacker-controlled out-of-bounds writes, heap corruption, and process termination even with legal per-row run codes. This tiled-path vulnerability is distinct from oversized CCITT runs in strip decoding. This issue is fixed in version 4.1.1.","datePublished":"Oct 6, 2026, 5:59:02 PM","dateUpdated":"Oct 6, 2026, 7:29:39 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-v76p-62qx-wwq2\nhttps://github.com/SixLabors/ImageSharp/pull/3176\nhttps://github.com/SixLabors/ImageSharp/commit/9ee7d1dd5b62d8c9f16cc755e76828386bc2191f\nhttps://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1\n","aliases":"CVE-2026-106118\nGHSA-v76p-62qx-wwq2\n","assigner":"GitHub_M","epss":0.6,"enisaIdProduct":[{"id":"bce90bc4-4cca-3634-aee2-71e281cf0a71","product":{"name":"ImageSharp","vendor":{"name":"SixLabors"}},"product_version":"3.0.0, \u003c 4.1.1"}],"enisaIdVendor":[{"id":"b59223a6-9c82-38ff-acb0-3b7fc1a44dba","vendor":{"name":"SixLabors"}}],"enisaIdVulnerability":[{"id":"6a09cd40-0c79-306d-acd5-537b15c7aa38","vulnerability":{"id":"GHSA-v76p-62qx-wwq2","description":"ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write","datePublished":"Oct 7, 2026, 4:18:57 PM","dateUpdated":"Oct 26, 2026, 4:04:11 PM","baseScore":0.0,"references":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-v76p-62qx-wwq2\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106118\nhttps://github.com/SixLabors/ImageSharp/pull/3176\nhttps://github.com/SixLabors/ImageSharp/pull/3208\nhttps://github.com/SixLabors/ImageSharp/commit/9ee7d1dd5b62d8c9f16cc755e76828386bc2191f\nhttps://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019\nhttps://github.com/SixLabors/ImageSharp\nhttps://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0\nhttps://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1\n","enisa_id":"EUVD-2026-93770\n","aliases":"CVE-2026-106118\nGHSA-v76p-62qx-wwq2\n","epss":0.0,"dataProcessed":"Oct 28, 2026, 2:02:34 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e272ebef-61b7-3cb4-a1f8-e895352c5f2f","vulnerability":{"id":"CVE-2026-106118","description":"ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constructs T4, T6, and Modified Huffman decompressors using the full frame width. TiffDecoderCore.DecodeTilesChunky can therefore direct frame-width fax scanlines into a tile-width buffer when TileWidth is smaller than ImageWidth. The mismatch causes attacker-controlled out-of-bounds writes, heap corruption, and process termination even with legal per-row run codes. This tiled-path vulnerability is distinct from oversized CCITT runs in strip decoding. This issue is fixed in version 4.1.1.","datePublished":"Oct 6, 2026, 5:59:02 PM","dateUpdated":"Oct 6, 2026, 7:29:39 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-v76p-62qx-wwq2\nhttps://github.com/SixLabors/ImageSharp/pull/3176\nhttps://github.com/SixLabors/ImageSharp/commit/9ee7d1dd5b62d8c9f16cc755e76828386bc2191f\nhttps://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1\n","enisa_id":"EUVD-2026-93770\n","assigner":"GitHub_M","epss":0.6,"dataProcessed":"Oct 27, 2026, 7:16:42 AM","vulnerabilityProduct":[{"id":"6362d7d7-66d8-3246-8125-f5326e75ba6a","product":{"name":"ImageSharp","vendor":{"name":"SixLabors"}},"product_version":"3.0.0, \u003c 4.1.1"}],"vulnerabilityVendor":[{"id":"3a87dd7a-aac5-3a20-8140-17e90d8308cf","vendor":{"name":"SixLabors"}}]}}],"enisaIdAdvisory":[]}