CVE-2026-106115

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-106115
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106115.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-106115
Aliases
Published
2026-10-06T17:50:15Z
Modified
2026-10-08T02:50:33Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
Details

ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked writes, and a decode-and-re-encode flow can inherit TiffCompression.CcittGroup4Fax and one-bit metadata from attacker-supplied input. The resulting out-of-bounds writes can corrupt memory and terminate the process. This issue is fixed in version 4.1.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106115.json"
}
References

Affected packages

Git / github.com/sixlabors/imagesharp

Affected ranges

Type
GIT
Repo
https://github.com/sixlabors/imagesharp
Events
Introduced
136cc143bba2fca255328751dd4580e4f8d413c3
Fixed
a9498c6db3642ef92c712ebc81e706914ac16a95
Fixed
dee414097e4be7bb35ef0209cf96bd0b61a7133a
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "2.1.0"
        },
        {
            "fixed": "4.1.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v2.*
v2.1.0
v2.1.1
v3.*
v3.0.0
v3.0.1
v3.1.0
v4.*
v4.0.0
v4.1.0
v4.1.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106115.json"