CVE-2026-106118 SixLabors CVE debrief

Who should care

Defenders responsible for ImageSharp deployments, particularly those handling TIFF images, should assess exposure and consider upgrading to version 4.1.1 or later. This vulnerability could be exploited through maliciously crafted TIFF files.

Why it matters

CVE-2026-106118 is a heap out-of-bounds write vulnerability in ImageSharp when decoding tiled TIFF images with fax compression. Defenders should assess exposure, particularly for versions between 3.0.0 and 4.1.0, and consider upgrading to version 4.1.1 or later. The vulnerability could be exploited through malicious TIFF files, potentially leading to process crashes or arbitrary code execution.

• Potential for heap corruption leading to process crashes or arbitrary code execution.
• Possible exploitation through malicious TIFF files.
• Requires verification of ImageSharp versions and exposure in the environment.
• Defenders need to prioritize patching or mitigating this vulnerability.

Technical summary

The vulnerability occurs when decoding tiled TIFF images with fax compression (T4/T6/MH) in ImageSharp. The `DecodeTilesChunky` method allocates a tile buffer based on `TileWidth`, but the fax decompressor is constructed with `frame.Width`, which ignores the `isTiled`, `tileWidth`, and `tileHeight` parameters. This mismatch causes the decompressor to write out of bounds, potentially leading to a heap out-of-bounds write.

Defensive priority

High

Recommended defensive actions

• Assess exposure by reviewing ImageSharp usage in your environment, particularly for versions between 3.0.0 and 4.1.0.
• Verify if your deployment processes involve handling TIFF images with fax compression.
• Consider upgrading to ImageSharp version 4.1.1 or later.
• Monitor for potential exploitation attempts targeting this vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on a heap out-of-bounds write vulnerability in ImageSharp when decoding tiled TIFF images with fax compression. The vulnerability is due to a mismatch between the allocated tile buffer size and the scanline length used by the fax decompressor.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.