CVE-2026-106111

Name of the Vulnerable Software and Affected Versions ImageSharp versions 4.0.0 through 4.1.1

Description In the 2D graphics library, the ExrBaseDecompressor.UndoZipCompression() function accepts a nonempty ZIP or ZIPS inflate result that is shorter than the required EXR block size. While ZipExrCompression.Decompress() reconstructs the returned prefix, ExrDecoderCore() processes the full expected block using a buffer from Configuration.Default. This behavior allows bytes remaining from a previous ImageSharp operation to be included in the decoded pixels. Consequently, applications that expose the output of an attacker-controlled EXR decode may disclose process-local image data.

Recommendations Update to version 4.1.2.