CVE-2026-106117

Summary

ImageSharp library has a heap buffer overflow vulnerability in TIFF decoding when processing CCITT Group 3 or Modified Huffman compressed strips. An attacker can craft malicious TIFF files that cause oversized data writes to heap buffers, potentially leading to process termination or memory corruption.

Exploitability

Exploitation is moderately difficult as it requires crafting a specially crafted TIFF file with oversized compression runs, but the vulnerability is remotely triggerable through image processing workflows without user interaction.

Blast radius

The impact is significant across any application using ImageSharp for TIFF image processing, particularly web applications that accept user-uploaded images or content management systems processing TIFF files.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to ImageSharp version 4.1.1 or later to fix the heap buffer overflow vulnerability in TIFF strip decompression.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.