SB2026082169 - Multiple vulnerabilities in ImageSharp

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082169

SB2026082169 - Multiple vulnerabilities in ImageSharp

Published: August 21, 2026

Security Bulletin ID SB2026082169
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in CCITT fax TIFF strip decompression via BitWriterUtils.WriteBits/WriteBit/WriteZeroBit when parsing an attacker-supplied fax-compressed strip TIFF image. A remote attacker can send a specially crafted TIFF file to cause a denial of service.

The issue affects strip TIFF images using Compression=2 or Compression=3, and no user interaction is required.


2) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in the TIFF fax decompression logic when decoding an attacker-supplied tiled TIFF image with fax compression. A remote attacker can send a specially crafted TIFF file to cause a denial of service.

The issue is triggered because the tile buffer is sized using TileWidth while the decompressor writes scanlines using the full image width.


Remediation

Install update from vendor's website.

References