CVE-2026-106112: ImageSharp: ICC LUT16 output channel count can write beyond Vector4
ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ICC LUT16 conversion accepts more than four output channels even though ClutCalculator.Calculate and LutEntryCalculator.CalculateLut store intermediate and output values in Vector4. When DecoderOptions.ColorProfileHandling is set to Convert, a malformed embedded profile can direct interpolation and output-LUT operations to write one float per declared channel beyond the four-float destination. This can corrupt memory and terminate the process; the default Preserve mode does not run ICC conversion. This issue is fixed in version 4.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ImageSharpto a version that resolves this vulnerability.Fixed in 4.1.2 - Configuration
Set DecoderOptions.ColorProfileHandling to Preserve to prevent ICC conversion of embedded profiles.
ImageSharp DecoderOptions.ColorProfileHandling = Preserve
Event History
Frequently Asked Questions
Which deployments are exposed?
ImageSharp versions from 4.0.0 through 4.1.2 are affected when ICC color-profile conversion is enabled by setting DecoderOptions.ColorProfileHandling to Convert. The default Preserve mode does not perform ICC conversion and does not trigger this issue.
What does an attacker need to exploit this?
An attacker needs to provide an image containing a malformed embedded ICC profile and have it processed with color-profile handling set to Convert. No authentication or user interaction is required according to the supplied severity vector.
What is the likely impact?
The malformed profile can cause writes beyond a four-float Vector4 destination during ICC LUT16 conversion. This can corrupt memory and terminate the process, creating a denial-of-service risk.
What should be done if updating is not immediately possible?
Avoid processing untrusted images with DecoderOptions.ColorProfileHandling set to Convert. Keep the default Preserve mode, which does not run the vulnerable ICC conversion path.
How can I remediate the issue?
Update SixLabors ImageSharp to version 4.1.2, which contains the fix.