CVE-2026-106110
No KEV entry is attached to this observation; this is not evidence that exploitation is absent.
FIRST EPSS: 0.39 % · percentile 32.32 % · scored 25 Oct 2026.
Observed 25 Oct 2026 15:18:41 UTC · Complete immutable risk JSON
CVE-2026-106110Published
ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer
Collected exploitation and prediction evidence
Risk source coverageCISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.
Dated risk observations
Risk history is separate from CNA/OSV content history. Daily score drift is retained but only an upward crossing of 10% triggers the prediction change event.
CVE-2026-106110 · 25 Oct 2026 15:18:41 UTC
Immutable source observations
3 recorded revisionsEach citation identifies one complete source statement. Source modification dates and the time this installation observed them are distinct. Latest history includes records historically associated by source identifiers; a removed alias is not a current equivalence claim. Exact citations show that source record's own earlier observations. Failed reads and unchanged polls do not rewrite history.
25 Oct 2026 04:17:41 UTC
ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row dat…
nvd · CVE-2026-106110 · Published
23 Oct 2026 16:01:25 UTC
ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer
osv · GHSA-j9gm-c75j-xc9q · Published
23 Oct 2026 15:48:27 UTC
ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer
cve-program · CVE-2026-106110 · Published