CVE-2026-106111Published

ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate

Collected exploitation and prediction evidence

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

CVE-2026-106111

Exact risk observation. Current source statements above are a separate evidence layer. Latest risk evidence.

No KEV entry is attached to this observation; this is not evidence that exploitation is absent.

FIRST EPSS: 0.28 % · percentile 19.46 % · scored 24 Oct 2026.

Observed 25 Oct 2026 02:24:38 UTC · Complete immutable risk JSON

Immutable source observations

3 recorded revisions

Each citation identifies one complete source statement. Source modification dates and the time this installation observed them are distinct. Latest history includes records historically associated by source identifiers; a removed alias is not a current equivalence claim. Exact citations show that source record's own earlier observations. Failed reads and unchanged polls do not rewrite history.

25 Oct 2026 04:17:41 UTC

ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR block's required size. ZipExrCompression.Decompress reconstructs …

nvd · CVE-2026-106111 · Published

23 Oct 2026 16:01:25 UTC

ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate

osv · GHSA-4q3p-rj5x-xv7p · Published

23 Oct 2026 15:48:27 UTC

ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate

cve-program · CVE-2026-106111 · Published