CVE-2026-106116
No KEV entry is attached to this observation; this is not evidence that exploitation is absent.
FIRST EPSS: 0.33 % · percentile 25.74 % · scored 25 Oct 2026.
Observed 25 Oct 2026 15:18:41 UTC · Complete immutable risk JSON
GHSA-wmxv-xphr-5c9gPublished
ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop
Collected exploitation and prediction evidence
Risk source coverageCISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.
Dated risk observations
Risk history is separate from CNA/OSV content history. Daily score drift is retained but only an upward crossing of 10% triggers the prediction change event.
CVE-2026-106116 · 25 Oct 2026 15:18:41 UTC
Immutable source observations
3 recorded revisionsEach citation identifies one complete source statement. Source modification dates and the time this installation observed them are distinct. Latest history includes records historically associated by source identifiers; a removed alias is not a current equivalence claim. Exact citations show that source record's own earlier observations. Failed reads and unchanged polls do not rewrite history.
25 Oct 2026 04:17:41 UTC
ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without adv…
nvd · CVE-2026-106116 · Published
23 Oct 2026 16:01:25 UTC
ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop
osv · GHSA-wmxv-xphr-5c9g · Published
23 Oct 2026 15:48:27 UTC
ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop
cve-program · CVE-2026-106116 · Published