CVE-2026-106110Published

ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer

cve-program · CVE-2026-106110

Published

ImageSharp

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "SixLabors",
                    "product": "ImageSharp",
                    "versions": [
                        {
                            "version": ">= 2.0.0, < 4.1.2",
                            "status": "affected"
                        }
                    ]
                }

nvd · CVE-2026-106110

Published

No affected-package array is stated in this source revision. Check its state and earlier observations; this does not establish that every package is unaffected.

osv · GHSA-j9gm-c75j-xc9q

Published

SixLabors.ImageSharp

NuGet

ECOSYSTEM · introduced 2.0.0 → fixed 4.1.2

34 explicitly affected versions

2.0.0, 2.1.0, 2.1.1, 2.1.10, 2.1.11, 2.1.12, 2.1.13, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 3.1.1, 3.1.10, 3.1.11, 3.1.12, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 4.0.0, 4.1.0, 4.1.1