CVE-2026-106115: ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked writes, and a decode-and-re-encode flow can inherit TiffCompression.CcittGroup4Fax and one-bit metadata from attacker-supplied input. The resulting out-of-bounds writes can corrupt memory and terminate the process. This issue is fixed in version 4.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ImageSharpto a version that resolves this vulnerability.Fixed in 4.1.2
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using ImageSharp versions 2.1.0 through 4.1.1 are affected when they encode TIFF images with CCITT Group 4 compression. A decode-and-re-encode workflow may preserve CCITT Group 4 compression and one-bit metadata from attacker-supplied TIFF input.
What does an attacker need to do to trigger the failure?
An attacker needs to cause the application to encode TIFF data using the CCITT Group 4 encoder. In applications that decode and re-encode uploaded images, a crafted input can cause the re-encoded output to retain the relevant compression and metadata settings.
What is the impact if exploitation succeeds?
Unchecked writes can exceed the encoder's allocated output buffer, corrupting memory and terminating the process. The reported impact is availability loss.
How can the issue be remediated?
Upgrade ImageSharp to version 4.1.2, which fixes the issue.