CVE-2026-106116Published

ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop

cve-program · CVE-2026-106116

Published

ImageSharp

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "SixLabors",
                    "product": "ImageSharp",
                    "versions": [
                        {
                            "version": ">= 2.0.0, < 4.1.2",
                            "status": "affected"
                        }
                    ]
                }

nvd · CVE-2026-106116

Published

No affected-package array is stated in this source revision. Check its state and earlier observations; this does not establish that every package is unaffected.

osv · GHSA-wmxv-xphr-5c9g

Published

SixLabors.ImageSharp

NuGet

ECOSYSTEM · introduced 2.0.0 → fixed 4.1.2

34 explicitly affected versions

2.0.0, 2.1.0, 2.1.1, 2.1.10, 2.1.11, 2.1.12, 2.1.13, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 3.1.1, 3.1.10, 3.1.11, 3.1.12, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 4.0.0, 4.1.0, 4.1.1