CVE-2026-106118: ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write
ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constructs T4, T6, and Modified Huffman decompressors using the full frame width. TiffDecoderCore.DecodeTilesChunky can therefore direct frame-width fax scanlines into a tile-width buffer when TileWidth is smaller than ImageWidth. The mismatch causes attacker-controlled out-of-bounds writes, heap corruption, and process termination even with legal per-row run codes. This tiled-path vulnerability is distinct from oversized CCITT runs in strip decoding. This issue is fixed in version 4.1.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ImageSharpto a version that resolves this vulnerability.Fixed in 4.1.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using Six Labors ImageSharp versions from 3.0.0 through versions before 4.1.1 are affected when they decode attacker-controlled tiled TIFF images using T4, T6, or Modified Huffman fax compression. The issue is reachable remotely without authentication or user interaction where untrusted images are processed.
What image properties are required to trigger the issue?
The TIFF must use tiled decoding and have a TileWidth smaller than the full ImageWidth. The affected fax decompressor then writes frame-width scanlines into a buffer allocated for the narrower tile width; legal per-row run codes can trigger the condition.
What is the impact of successful exploitation?
The mismatch produces attacker-controlled heap out-of-bounds writes, which can corrupt heap memory and terminate the process. The provided severity vector indicates availability impact, with no stated confidentiality or integrity impact.
What should be done if upgrading cannot happen immediately?
Avoid decoding untrusted tiled TIFF files that use fax compression, particularly T4, T6, or Modified Huffman compression, and reject or isolate such inputs before ImageSharp processes them. Upgrade to ImageSharp 4.1.1 when possible.