CVE-2026-106113 SixLabors CVE debrief

Who should care

Defenders responsible for image processing systems, especially those using ImageSharp, should assess exposure and prioritize updating to version 4.1.2 or later. They should also review and restrict image processing inputs to prevent attacker-supplied TIFFs and monitor systems for process termination and potential exploitation attempts. This includes verifying affected deployments, reviewing official advisories, and ensuring proper security measures are in

Why it matters

CVE-2026-106113 in ImageSharp can lead to process termination. Defenders should verify and update to version 4.1.2, restrict image inputs, and monitor systems.

• Process termination due to out-of-range access
• Potential for denial-of-service attacks
• Need for verification of image processing inputs

Technical summary

The vulnerability occurs when decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization, which can produce a non-finite or out-of-range luminance. This causes an unsafe out-of-range access and process termination. The issue is addressed in ImageSharp version 4.1.2, which validates luminance values to prevent such attacks. Defenders should focus on updating to the latest version and restricting image inputs to mitigate this vulnerability effectively in their environments.

Defensive priority

Defenders should prioritize verifying and updating ImageSharp to version 4.1.2 or later, especially in systems handling image processing.

Recommended defensive actions

• Verify and update ImageSharp to version 4.1.2 or later
• Review and restrict image processing inputs to prevent attacker-supplied TIFFs
• Monitor systems for process termination and potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is confirmed in ImageSharp versions 2.0.0 to 4.1.1. Decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance. This issue is fixed in version 4.1.2. Defenders should verify image processing inputs and monitor systems for potential exploitation attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.