CVE-2026-106115Published

ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer

cve-program · CVE-2026-106115

Published

ImageSharp

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "SixLabors",
                    "product": "ImageSharp",
                    "versions": [
                        {
                            "version": ">= 2.1.0, < 4.1.2",
                            "status": "affected"
                        }
                    ]
                }

nvd · CVE-2026-106115

Published

No affected-package array is stated in this source revision. Check its state and earlier observations; this does not establish that every package is unaffected.

osv · GHSA-jjfr-hcj7-qf5w

Published

SixLabors.ImageSharp

NuGet

ECOSYSTEM · introduced 2.1.0 → fixed 4.1.2

33 explicitly affected versions

2.1.0, 2.1.1, 2.1.10, 2.1.11, 2.1.12, 2.1.13, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 3.1.1, 3.1.10, 3.1.11, 3.1.12, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 4.0.0, 4.1.0, 4.1.1