CVE-2026-106118

Name of the Vulnerable Software and Affected Versions ImageSharp versions 3.0.0 through 4.1.0

Description In the tiled TIFF decoding process, a destination buffer is allocated using TileWidth, but the TiffDecompressorsFactory.Create function constructs T4, T6, and Modified Huffman decompressors using the full frame width. Consequently, the TiffDecoderCore.DecodeTilesChunky function can direct frame-width fax scanlines into a tile-width buffer when TileWidth is smaller than ImageWidth. This mismatch leads to attacker-controlled out-of-bounds writes, heap corruption, and process termination.

Recommendations Update to version 4.1.1.