CVE-2026-106115

Name of the Vulnerable Software and Affected Versions ImageSharp versions 2.1.0 through 4.1.1

Description The TIFF CCITT Group 4 encoder in this 2D graphics library allocates memory based on Width times rowsPerStrip bytes. However, the T6BitCompressor.CompressStrip function can produce encoded row data and two 12-bit end-of-facsimile-block codes that exceed this allocated capacity. The TiffCcittCompressor.WriteCode function performs unchecked writes, and a decode-and-re-encode process can inherit TiffCompression.CcittGroup4Fax and one-bit metadata from malicious input. This leads to out-of-bounds writes, which can corrupt memory and cause the process to terminate.

Recommendations Update to version 4.1.2.