CVE-2026-106111: CWE-226: Sensitive Information in Resource Not Removed Before Reuse in SixLabors ImageSharp

CVE-2026-106111 describes a vulnerability in the SixLabors ImageSharp 2D graphics library affecting versions from 4.0.0 up to but not including 4.1.2. The flaw exists in the ExrBaseDecompressor.UndoZipCompression method, which accepts a ZIP or ZIPS inflate result shorter than the expected EXR block size. The decompression process reconstructs the prefix and processes the full expected block from a buffer obtained via Configuration.Default. This buffer reuse allows bytes retained from a previous ImageSharp operation to appear in the decoded pixels, potentially disclosing sensitive process-local image data when applications expose these pixels or output from the attacker-controlled EXR decode. The vulnerability is addressed in version 4.1.2.

The vulnerability can lead to disclosure of sensitive image data from prior operations within the same process. This exposure occurs when applications output or expose pixels decoded from a crafted EXR image, potentially leaking confidential information. There is no indication of integrity or availability impact. The CVSS v3.1 base score is 5.9 (medium severity), reflecting a network attack vector with high complexity and no privileges required, resulting in high confidentiality impact but no integrity or availability impact.

Upgrade to SixLabors ImageSharp version 4.1.2 or later, where this vulnerability is fixed. No other mitigations are indicated or required according to the available data.