CVE-2026-106114: ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions
ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and earlier public IccProfile.Entries parsing paths can allocate a large jagged representation, from a short truncated profile. In version 4, automatic image conversion reaches the parser when DecoderOptions.ColorProfileHandling is Convert; the default Preserve mode avoids that conversion path. The demonstrated impact is memory pressure and input-validation failure, not unhandled process termination. This issue is fixed in version 4.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.1.2 - Configuration
Set DecoderOptions.ColorProfileHandling to Preserve to avoid the automatic image-conversion path that reaches the ICC parser.
ImageSharp DecoderOptions.ColorProfileHandling = Preserve
Event History
Frequently Asked Questions
Which deployments are exposed to the automatic parsing path in version 4?
In version 4, the automatic image-conversion path reaches the vulnerable ICC parser only when DecoderOptions.ColorProfileHandling is set to Convert. The default Preserve mode avoids that conversion path.
What must an attacker provide to trigger the issue?
An attacker needs to supply an ICC profile with declared channel and grid dimensions that cause large allocations before the parser verifies that the profile contains the declared values. A short, truncated profile can trigger the affected allocation behavior.
What is the demonstrated impact?
The demonstrated impact is memory pressure and input-validation failure. The available information does not demonstrate unhandled process termination.
What can be done if upgrading is not immediately possible?
For version 4 automatic conversion, keep DecoderOptions.ColorProfileHandling in its default Preserve mode rather than Convert. This avoids the described automatic conversion path to the ICC parser.
Which versions are affected and fixed?
The issue affects ImageSharp versions from 1.0.0-beta0001 through 4.1.2. Version 4.1.2 is identified as the fixed version.