CVE-2025-27598: Out-of-bounds Write in SixLabors ImageSharp
Impact An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service.
Patches The problem has been patched. All users are advised to upgrade to v3.1.7 or v2.1.10.
Workarounds None.
References https://github.com/SixLabors/ImageSharp/issues/2859 https://github.com/SixLabors/ImageSharp/issues/2890
Other sources
ImageSharp is a 2D graphics API. An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service. The problem has been patched. All users are advised to upgrade to v3.1.7 or v2.1.10.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nuget/SixLabors.ImageSharpto a version that resolves this vulnerability.Fixed in 2.1.10 - Upgrade
Upgrade
nuget/SixLabors.ImageSharpto a version that resolves this vulnerability.Fixed in 3.1.7 - Upgrade
Upgrade
SixLabors ImageSharpto a version that resolves this vulnerability.Fixed in 3.1.7 - Upgrade
Upgrade
SixLabors ImageSharpto a version that resolves this vulnerability.Fixed in 2.1.10
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27598?
CVE-2025-27598 has a severity rating that indicates it can lead to denial of service.
How do I fix CVE-2025-27598?
To fix CVE-2025-27598, update to ImageSharp version 3.1.8 or later, or version 2.1.11 or later.
What causes CVE-2025-27598?
CVE-2025-27598 is caused by an out-of-bounds write vulnerability in the ImageSharp gif decoder.
What versions of ImageSharp are affected by CVE-2025-27598?
Versions up to 3.1.7 and 2.1.10 of ImageSharp are affected by CVE-2025-27598.
Can CVE-2025-27598 be exploited remotely?
Yes, CVE-2025-27598 can be exploited remotely using a specially crafted gif file.