SB2026091650 - Multiple vulnerabilities in ImageSharp

Main Vulnerability Database SB2026091650

SB2026091650 - Multiple vulnerabilities in ImageSharp

Published: September 16, 2026

Security Bulletin ID SB2026091650

CSH Severity

Medium

Patch available

YES

Number of vulnerabilities 7

Exploitation vector Remote access

Highest impact Denial of service

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 7 vulnerabilities.

1) Uncontrolled Memory Allocation (CVE-ID: N/A)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to excessive memory allocation in the ReadClutF32 ICC CLUT parser when processing a malformed embedded ICC profile. A remote attacker can supply an image containing a malformed ICC profile to cause a denial of service.

In version 4, the affected conversion path is reached only when ICC color-profile conversion is enabled.

2) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in GrayscaleLevelsRowOperation when processing attacker-supplied 32-bit floating-point TIFF images through HistogramEqualization(). A remote attacker can supply a TIFF image containing non-finite or out-of-range luminance values to cause a denial of service.

The report covers HistogramEqualization() only and does not claim Adaptive Histogram Equalization or AutoLevel behavior.

3) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a loop with an unreachable exit condition in the ReadValues64 BigTIFF IFD entry parser when decoding a malformed BigTIFF image with a declared entry count exceeding the available entry data. A remote attacker can supply a crafted BigTIFF image with a large IFD entry count to cause a denial of service.

4) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in T6BitCompressor.WriteCode when encoding a 1-bit TIFF image with CCITT Group 4 compression. A remote attacker can supply a crafted Group 4 TIFF that is decoded and re-encoded to cause a denial of service.

The issue is limited to the T6 encoder path.

5) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the TIFF CCITT Group 3 (T4) encoder when encoding narrow 1-bit images with CcittGroup3Fax compression. A remote attacker can cause unchecked writes beyond the compressed-data buffer to cause a denial of service.

The affected path may be reached when an application re-encodes TIFF input while retaining its compression and bit-depth metadata.

6) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the ICC LUT16 CLUT and output-LUT conversion path when decoding an image containing a malformed embedded ICC profile with more than four output channels. A remote attacker can supply a specially crafted image to cause a denial of service.

Exploitation requires ICC conversion to be enabled through DecoderOptions.ColorProfileHandling set to Convert.

7) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: N/A)

CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to sensitive information in a resource not removed before reuse in the ZIP-compressed OpenEXR decoder when processing a crafted OpenEXR image with a short non-empty inflate result. A remote attacker can supply a crafted ZIP-compressed OpenEXR image to disclose sensitive information.

The disclosure is process-local and can expose data from a completed prior ImageSharp operation when the shared Configuration.Default allocator is used and decoded pixels or derived output are exposed.

Remediation

Install update from vendor's website.

References