CVE-2026-106115
7.5 HIGHpublic exploit availablePublished 2026-10-06 · Updated 2026-10-09
AI risk analysis
- Summary
- ImageSharp's TIFF CCITT Group 4 encoder has a buffer overflow vulnerability that can lead to arbitrary code execution when processing specially crafted TIFF images. This occurs due to unchecked writes beyond allocated memory boundaries during compression.
- Exploitability
- Exploitation requires an attacker to provide a malicious TIFF image with specific metadata and compression settings, making it moderately difficult but possible to achieve remote code execution through a simple file upload or processing workflow.
- Blast radius
- The vulnerability affects any application using ImageSharp's TIFF encoding functionality, particularly those processing untrusted TIFF files from web uploads, file transfers, or document processing pipelines, potentially leading to widespread service disruption or compromise.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to version 4.1.2 or later to remediate the buffer overflow in TIFF CCITT Group 4 encoding.
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked writes, and a decode-and-re-encode flow can inherit TiffCompression.CcittGroup4Fax and one-bit metadata from attacker-supplied input. The resulting out-of-bounds writes can corrupt memory and terminate the process. This issue is fixed in version 4.1.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-787
Public exploit & PoC references
- https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95
- https://github.com/SixLabors/ImageSharp/pull/3187
- https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2
- https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w
- https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w
All references
- https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95
- https://github.com/SixLabors/ImageSharp/pull/3187
- https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2
- https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w
- https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-106110PoC
- HIGHCVE-2026-106118PoC
- CRITICALCVE-2026-14991
- HIGHCVE-2026-18095
- HIGHCVE-2026-82335
- HIGHCVE-2026-82344
- CRITICALCVE-2026-85746PoC
- HIGHCVE-2026-91789
Related by shared AI tags and CWE weakness class. Browse the full archive.