CVE-2026-106112

Summary

ImageSharp library suffers from a buffer overflow vulnerability in its ICC profile handling when processing LUT16 conversions with more than four output channels. This allows attackers to corrupt memory and potentially terminate processes when embedded profiles are processed with Convert mode, affecting applications that use ImageSharp for image processing.

Exploitability

Exploitation requires a crafted malformed ICC profile embedded in an image file, making it moderately difficult but possible to trigger through image upload or processing workflows without complex payloads.

Blast radius

The vulnerability affects any application using ImageSharp 4.0.0 through 4.1.2 with ICC profile conversion enabled, potentially causing widespread process termination and denial of service across image processing pipelines.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to ImageSharp version 4.1.2 or later to fix the buffer overflow in ICC LUT16 conversion handling.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.