CVE-2026-106114 in ImageSharp
Summary
by MITRE • 10/06/2026
ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and earlier public IccProfile.Entries parsing paths can allocate a large jagged representation, from a short truncated profile. In version 4, automatic image conversion reaches the parser when DecoderOptions.ColorProfileHandling is Convert; the default Preserve mode avoids that conversion path. The demonstrated impact is memory pressure and input-validation failure, not unhandled process termination. This issue is fixed in version 4.1.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
ImageSharp is a widely used open-source library for handling 2D graphics operations within .NET applications, providing functionality for image decoding, encoding, and manipulation. A significant security vulnerability was identified in versions ranging from 1.0.0-beta0001 through 4.1.2 regarding the parsing of International Color Consortium profiles embedded within images. Specifically, the flaw resides in how the library handles Indexed Color Lookup Tables when processing ICC CLUT data structures. The core technical deficiency involves a lack of input validation prior to memory allocation. When an attacker supplies a maliciously crafted image file containing a truncated or malformed ICC profile, the parsing logic calculates the required array sizes based on channel and grid dimensions declared within that untrusted metadata without first verifying whether the actual binary content contains sufficient data to support those declarations.
This architectural flaw allows for two distinct exploitation vectors depending on the specific code path triggered during processing. In one scenario involving the IccDataReader.ReadClutF32 method, the library may request a large array of floating-point numbers based solely on attacker-controlled values found in the header. In another scenario related to earlier public parsing paths within IccProfile.Entries, the system allocates a jagged array representation that can grow disproportionately relative to the actual file size if the profile is truncated but declares high dimensionality. Because these allocations occur before validation checks confirm data integrity, an attacker can induce excessive memory consumption by providing small files with large declared dimensions. This behavior directly leads to severe memory pressure on the host system or application process, potentially causing performance degradation, resource exhaustion, or denial of service conditions as the garbage collector struggles to manage rapidly expanding heap usage.
The operational impact is characterized primarily by input-validation failure and subsequent resource exhaustion rather than immediate unhandled exceptions that would terminate the process outright. This distinction makes the vulnerability particularly insidious in production environments where memory limits are not strictly capped at the application level, allowing an attacker to gradually degrade system stability over time through repeated requests of crafted payloads. The risk is further amplified when automatic image conversion features are enabled. In version 4 of ImageSharp, if DecoderOptions.ColorProfileHandling is set to Convert rather than the default Preserve mode, the library automatically processes color profiles during decoding, thereby exposing users who rely on standard configurations or explicit conversion settings to this vulnerability without requiring specialized attack vectors beyond a malformed input file.
From a classification perspective, this issue aligns with CWE-789: Memory Allocation with Excessive Size Value and CWE-20: Improper Input Validation. The exploitation technique involves crafting specific binary inputs to trigger resource exhaustion, which maps to the ATT&CK tactic of Impact under techniques such as Resource Hijacking or Denial of Service via application layer attacks. To mitigate this risk, organizations utilizing ImageSharp must ensure they are running version 4.1.2 or later where these allocation checks have been corrected to validate data availability before committing memory resources. For environments unable to upgrade immediately, configuring DecoderOptions.ColorProfileHandling to Preserve instead of Convert can bypass the vulnerable automatic conversion path in affected versions, although upgrading remains the definitive remediation strategy to ensure comprehensive protection against similar flaws that may exist elsewhere in the parsing logic.