CVE-2026-106111 SixLabors CVE debrief

Who should care

Defenders of applications using ImageSharp for image processing, especially those exposing decoded image data or using shared allocators, should assess their exposure and prioritize verification and remediation.

Why it matters

CVE-2026-106111 is an information disclosure vulnerability in ImageSharp's EXR ZIP decoder. Defenders should verify and remediate to prevent potential exposure of sensitive data.

• Potential information disclosure through exposure of stale memory
• Verification of application usage of shared allocators is necessary
• Remediation requires upgrading to ImageSharp version 4.1.2 or later
• Assessment of decoded image data exposure is crucial

Technical summary

The ZIP decoder in ImageSharp accepts a non-empty inflate result shorter than the EXR block's required size, leading to exposure of stale memory from prior operations. This process-local, cross-operation information-disclosure defect is relevant when an application uses the shared `Configuration.Default` allocator for separate image operations and exposes pixels or output derived from a later attacker-controlled EXR decode. Defenders should prioritize verifying and upgrading to ImageSharp version 4.1.2 or later, reviewing application usage of shared allocators, and assessing exposure of decoded image data.

Defensive priority

Defenders should prioritize verifying and upgrading to ImageSharp version 4.1.2 or later, reviewing application usage of shared allocators, and assessing exposure of decoded image data.

Recommended defensive actions

• Verify and upgrade to ImageSharp version 4.1.2 or later
• Review application usage of shared allocators for separate image operations
• Assess exposure of decoded image data
• Monitor for potential information disclosure
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The source corpus provides details on the affected ImageSharp versions (4.0.0, 4.1.0, 4.1.1) and the fixed version (4.1.2). The defect is in the ZIP decoder accepting a non-empty inflate result shorter than the EXR block's required size.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.