CVE-2026-106115Published

ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer

Collected exploitation and prediction evidence

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

CVE-2026-106115

Exact risk observation. Current source statements above are a separate evidence layer. Latest risk evidence.

No KEV entry is attached to this observation; this is not evidence that exploitation is absent.

FIRST EPSS: 0.39 % · percentile 32.32 % · scored 25 Oct 2026.

Observed 25 Oct 2026 15:18:41 UTC · Complete immutable risk JSON

Immutable source observations

3 recorded revisions

Each citation identifies one complete source statement. Source modification dates and the time this installation observed them are distinct. Latest history includes records historically associated by source identifiers; a removed alias is not a current equivalence claim. Exact citations show that source record's own earlier observations. Failed reads and unchanged polls do not rewrite history.

25 Oct 2026 04:17:41 UTC

ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block c…

nvd · CVE-2026-106115 · Published

23 Oct 2026 16:01:25 UTC

ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer

osv · GHSA-jjfr-hcj7-qf5w · Published

23 Oct 2026 15:48:27 UTC

ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer

cve-program · CVE-2026-106115 · Published