Out-of-bounds write in ImageSharp - #VU144574
Published: August 21, 2026
Vulnerability identifier: #VU144574
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in the TIFF fax decompression logic when decoding an attacker-supplied tiled TIFF image with fax compression. A remote attacker can send a specially crafted TIFF file to cause a denial of service.
The issue is triggered because the tile buffer is sized using TileWidth while the decompressor writes scanlines using the full image width.
Affected software
ImageSharp
Remediation
Install security update from vendor's website.
ImageSharp - update to 4.1.1