CVE-2026-106114
No KEV entry is attached to this observation; this is not evidence that exploitation is absent.
FIRST EPSS: 0.33 % · percentile 25.74 % · scored 25 Oct 2026.
Observed 25 Oct 2026 15:18:41 UTC · Complete immutable risk JSON
CVE-2026-106114Published
ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions
Collected exploitation and prediction evidence
Risk source coverageCISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.
Dated risk observations
Risk history is separate from CNA/OSV content history. Daily score drift is retained but only an upward crossing of 10% triggers the prediction change event.
CVE-2026-106114 · 25 Oct 2026 15:18:41 UTC
Immutable source observations
3 recorded revisionsEach citation identifies one complete source statement. Source modification dates and the time this installation observed them are distinct. Latest history includes records historically associated by source identifiers; a removed alias is not a current equivalence claim. Exact citations show that source record's own earlier observations. Failed reads and unchanged polls do not rewrite history.
25 Oct 2026 04:17:41 UTC
ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataRe…
nvd · CVE-2026-106114 · Published
23 Oct 2026 16:01:25 UTC
ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions
osv · GHSA-gwg2-r3hj-4w44 · Published
23 Oct 2026 15:48:27 UTC
ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions
cve-program · CVE-2026-106114 · Published