CVE-2026-106111
ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate
MEDIUM 5.9EPSS 0.4%
ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR block's required size. ZipExrCompression.Decompress reconstructs the returned prefix while ExrDecoderCore processes the full expected block from a buffer obtained through Configuration.Default, allowing bytes retained from a completed prior ImageSharp operation to appear in decoded pixels. Applications that expose pixels or output from the later attacker-controlled EXR decode can disclose process-local image data. This issue is fixed in version 4.1.2.
- Affected
- SixLabors · ImageSharp
- CVSS v3.1 GITHUB
- 5.9 MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS
- 0.35% chance of exploitation in the next 30 days, 27th percentile
- Published
- 2026-10-06