CVE-2026-106115 in ImageSharp
Summary
by MITRE • 10/06/2026
ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked writes, and a decode-and-re-encode flow can inherit TiffCompression.CcittGroup4Fax and one-bit metadata from attacker-supplied input. The resulting out-of-bounds writes can corrupt memory and terminate the process. This issue is fixed in version 4.1.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified within ImageSharp, specifically affecting versions ranging from 2.1.0 through 4.1.2, represents a critical heap-based buffer overflow rooted in incorrect size calculations during the encoding of TIFF images using CCITT Group 4 compression. This library is widely utilized for high-performance image processing in .NET environments, and its widespread adoption means that any flaw in core rendering or conversion logic can have significant security implications across numerous applications relying on it for handling untrusted image data. The specific defect occurs within the TiffCcittCompressor component when encoding images with CCITT Group 4 compression, a standard often used for fax transmission due to its efficiency with black-and-white imagery.
The technical root cause lies in how the encoder allocates memory buffers prior to performing the actual compression operation. During initialization, the library calculates the required buffer size by multiplying the image width by the number of rows per strip. This calculation assumes that the compressed output will fit within this linear allocation based on input dimensions alone. However, the underlying T6BitCompressor.CompressStrip method has the capability to emit encoded row data along with two additional 12-bit end-of-facsimile-block codes at the conclusion of each strip. These trailing codes are necessary for proper stream termination according to the CCITT Group 4 specification but were not accounted for in the initial buffer size calculation. Consequently, when the compressor writes these final bytes, it exceeds the bounds of the allocated memory region.
This out-of-bounds write is exacerbated by the use of unchecked arithmetic operations within TiffCcittCompressor.WriteCode. In many programming contexts, including C#, unchecked blocks allow integer overflows to wrap around silently rather than throwing exceptions, but in this specific case, it facilitates a direct overwrite beyond the intended buffer boundary without immediate detection. The vulnerability becomes particularly dangerous when combined with decode-and-re-encode workflows. An attacker can supply a maliciously crafted TIFF file that utilizes TiffCompression.CcittGroup4 and includes one-bit metadata fields. When such an image is processed by vulnerable versions of ImageSharp, the library decodes the input to reconstruct its internal representation and then re-encodes it using CCITT Group 4 compression. During this re-encoding phase, the aforementioned buffer overflow occurs because the output size calculation fails to accommodate the mandatory termination codes appended by the compressor logic.
The operational impact of this vulnerability is severe, primarily manifesting as memory corruption that can lead to application crashes or denial-of-service conditions. By overwriting adjacent heap metadata or other data structures, an attacker may potentially achieve arbitrary code execution if they can carefully control the contents written beyond the buffer boundary and manipulate subsequent allocation patterns. While exploitation for remote code execution requires sophisticated heap grooming techniques typical of modern memory corruption vulnerabilities, the immediate effect is often process termination due to access violations triggered by writing to unmapped or protected memory pages. This makes the vulnerability a reliable vector for causing service disruptions in applications that automatically process uploaded images without strict size or format validation prior to processing.
From a classification perspective, this flaw aligns with CWE-120 Buffer Copy without Checking Size of Input Classic buffer overflow and CWE-787 Out-of-bounds Write. The attack vector typically involves supplying crafted input data, which corresponds to the ATT&CK technique T1190 Exploit Public-Facing Application if the vulnerability is triggered via a web service or API endpoint that accepts image uploads. Mitigation strategies primarily involve upgrading ImageSharp to version 4.1.2 or later, where this calculation error has been corrected to include space for the end-of-facsimile-block codes in the buffer allocation logic. For organizations unable to immediately upgrade, implementing strict input validation and limiting the types of compression formats accepted by image processing pipelines can reduce exposure. Additionally, deploying runtime application self-protection tools or memory safety wrappers may help detect abnormal heap behavior indicative of such overflows before they lead to critical system failures.