CVE-2026-106111

MEDIUM 5.9

ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate

CVSS Score

5.9

EPSS Score

0.0%

EPSS Percentile

0th

ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR block's required size. ZipExrCompression.Decompress reconstructs the returned prefix while ExrDecoderCore processes the full expected block from a buffer obtained through Configuration.Default, allowing bytes retained from a completed prior ImageSharp operation to appear in decoded pixels. Applications that expose pixels or output from the later attacker-controlled EXR decode can disclose process-local image data. This issue is fixed in version 4.1.2.

CWE	CWE-226
Vendor	sixlabors
Product	imagesharp
Published	Oct 6, 2026
Last Updated	Oct 6, 2026

Stay Ahead of the Next One

Get instant alerts for sixlabors imagesharp

Be the first to know when new medium vulnerabilities affecting sixlabors imagesharp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

SixLabors / ImageSharp

>= 4.0.0, < 4.1.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-4q3p-rj5x-xv7p github.com: https://github.com/SixLabors/ImageSharp/pull/3187 github.com: https://github.com/SixLabors/ImageSharp/commit/3c43cf583fdd98eff0f451397affaa31c6a2e6b1 github.com: https://github.com/SixLabors/ImageSharp/commit/6ed2a275217d39301e76df42acec2a9533b39d2b github.com: https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2