CVE-2026-106114: CWE-789: Memory Allocation with Excessive Size Value in SixLabors ImageSharp

ImageSharp versions >=1.0.0-beta0001 and <4.1.2 contain a vulnerability in the ICC CLUT parsing logic. Specifically, the IccDataReader.ReadClutF32 method can request a large float array based on attacker-declared channel and grid dimensions before confirming that the profile actually contains those values. Earlier parsing paths in IccProfile.Entries can also allocate large jagged arrays from truncated profiles. In version 4, automatic image conversion triggers this parser when DecoderOptions.ColorProfileHandling is set to Convert, though the default Preserve mode avoids this path. The vulnerability results in memory pressure and input-validation failure but does not cause unhandled process termination. The issue is resolved in version 4.1.2.

The vulnerability can cause excessive memory allocation leading to memory pressure and potential denial of service conditions due to input-validation failure. There is no impact on confidentiality or integrity, and no unhandled process termination has been demonstrated. No known exploits are reported in the wild.

Upgrade to ImageSharp version 4.1.2 or later, where this issue is fixed. Until then, avoid using DecoderOptions.ColorProfileHandling set to Convert to prevent triggering the vulnerable parsing path. Patch status is confirmed fixed in 4.1.2.