CVE-2026-106117: CWE-787: Out-of-bounds Write in SixLabors ImageSharp

CVE-2026-106117 is an out-of-bounds write vulnerability (CWE-787) in the SixLabors ImageSharp 2D graphics library affecting versions from 3.0.0 to before 4.1.1. The issue arises during decoding of strip TIFF images compressed with CCITT Group 3 or Modified Huffman compression. Specifically, the BitWriterUtils.WriteBits method can receive attacker-expanded runs without verifying the current row width first. The T4TiffCompression.WritePixelRun method can accumulate oversized makeup-code runs, and ModifiedHuffmanTiffCompression.Decompress only validates the width after writing. This unchecked write leads to buffer overflow in the strip buffer, resulting in heap corruption and process termination. This vulnerability is distinct from other tiled decompressor-width mismatch issues. The vendor fixed this vulnerability in ImageSharp version 4.1.1.

Successful exploitation can cause heap memory corruption and termination of the affected process, leading to denial of service. There is no indication of confidentiality or integrity impact. The CVSS v3.1 score is 7.5 (High) with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability.

Upgrade to SixLabors ImageSharp version 4.1.1 or later, where this vulnerability is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in 4.1.1.