CVE-2026-106117

Name of the Vulnerable Software and Affected Versions ImageSharp versions 3.0.0 through 4.1.0

Description Decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression allows the passing of attacker-expanded runs to BitWriterUtils.WriteBits without verifying the current row width. Specifically, T4TiffCompression.WritePixelRun can accumulate oversized makeup-code runs, and ModifiedHuffmanTiffCompression.Decompress performs width validation only after the writing process. These unchecked writes can lead to a strip buffer overflow, resulting in heap memory corruption and process termination.

Recommendations Update to version 4.1.1.