- Latest release
- 4.1.3 (Oct 9, 2026): no advisory affects it
- Newest unaffected release
- 4.1.3 (Oct 9, 2026), the latest release
- Advisories
- 15 · 8 high, 7 medium
- Releases
- 52 since 1.0.0 (Aug 4, 2020)
- Registry
- NuGet
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-106118Affects 3.0.0 to 3.1.12 (3.2.0 is outside it); 4.0.0 to 4.1.0 (4.1.1 is outside it)
- CVE-2026-106116Affects 2.0.0 to 4.1.1 (4.1.2 is outside it)
- CVE-2026-106115Affects 2.1.0 to 4.1.1 (4.1.2 is outside it)
- CVE-2026-106114Affects 1.0.0-beta0001 to 3.1.12 (3.2.0 is outside it); 4.0.0 to 4.1.1 (4.1.2 is outside it)
- CVE-2026-106113Affects 2.0.0 to 4.1.1 (4.1.2 is outside it)
- CVE-2026-106112Affects 4.0.0 to 4.1.1 (4.1.2 is outside it)
- CVE-2026-106111Affects 4.0.0 to 4.1.1 (4.1.2 is outside it)
- CVE-2026-106110Affects 2.0.0 to 4.1.1 (4.1.2 is outside it)
- CVE-2025-54575Affects 1.0.0-beta0001 to 2.1.10 (2.1.11 is outside it); 3.0.0 to 3.1.10 (3.1.11 is outside it)
- CVE-2025-27598Affects 1.0.0-beta0001 to 2.1.9 (2.1.10 is outside it); 3.0.0 to 3.1.6 (3.1.7 is outside it)
- CVE-2024-41132Affects 1.0.0-beta0001 to 2.1.8 (2.1.9 is outside it); 3.0.0 to 3.1.4 (3.1.5 is outside it)
- CVE-2024-41131Affects 1.0.0-beta0001 to 2.1.8 (2.1.9 is outside it); 3.0.0 to 3.1.4 (3.1.5 is outside it)
Show all 15 advisoriesShow fewer advisories
- CVE-2024-32036Affects 1.0.0-beta0001 to 2.1.7 (2.1.8 is outside it); 3.0.0 to 3.1.3 (3.1.4 is outside it)
- CVE-2024-32035Affects 1.0.0-beta0001 to 2.1.7 (2.1.8 is outside it); 3.0.0 to 3.1.3 (3.1.4 is outside it)
- CVE-2024-27929Affects 1.0.0-beta0001 to 2.1.6 (2.1.7 is outside it); 3.0.0 to 3.1.2 (3.1.3 is outside it)
Advisories 15
- CVE-2026-106118High 7.5
ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write
Affected: from 3.0.0, fixed in 3.2.0; from 4.0.0, fixed in 4.1.1.
Fixed in 3.2.0 (released Oct 9, 2026, 3 days after disclosure) and 4.1.1 (released Aug 20, 2026, 47 days before disclosure).
The latest release, 4.1.3, is not affected.
- CVE-2026-106116Medium 5.3
ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop
Affected: from 2.0.0, fixed in 4.1.2.
Fixed in 4.1.2 (released Sep 14, 2026, 22 days before disclosure).
The latest release, 4.1.3, is not affected.
- CVE-2026-106115High 7.5
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
Affected: from 2.1.0, fixed in 4.1.2.
Fixed in 4.1.2 (released Sep 14, 2026, 22 days before disclosure).
The latest release, 4.1.3, is not affected.
- CVE-2026-106114Medium 5.3
ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions
Affected: from 4.0.0, fixed in 4.1.2; from 1.0.0-beta0001, fixed in 3.2.0.
Fixed in 3.2.0 (released Oct 9, 2026, 3 days after disclosure) and 4.1.2 (released Sep 14, 2026, 22 days before disclosure).
The latest release, 4.1.3, is not affected.
- CVE-2026-106113High 7.5
ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index
Affected: from 2.0.0, fixed in 4.1.2.
Fixed in 4.1.2 (released Sep 14, 2026, 22 days before disclosure).
The latest release, 4.1.3, is not affected.
- CVE-2026-106112High 7.5
ImageSharp: ICC LUT16 output channel count can write beyond Vector4
Affected: from 4.0.0, fixed in 4.1.2.
Fixed in 4.1.2 (released Sep 14, 2026, 22 days before disclosure).
The latest release, 4.1.3, is not affected.
- CVE-2026-106111Medium 5.9
ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate
Affected: from 4.0.0, fixed in 4.1.2.
Fixed in 4.1.2 (released Sep 14, 2026, 22 days before disclosure).
The latest release, 4.1.3, is not affected.
- CVE-2026-106110High 7.5
ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer
Affected: from 2.0.0, fixed in 4.1.2.
Fixed in 4.1.2 (released Sep 14, 2026, 22 days before disclosure).
The latest release, 4.1.3, is not affected.
- CVE-2025-54575Medium 5.3
ImageSharp Triggers an Infinite Loop in its GIF Decoder When Skipping Malformed Comment Extension Blocks
Affected: fixed in 2.1.11; from 3.0.0, fixed in 3.1.11.
Fixed in 2.1.11 (released Jul 30, 2025, the day of disclosure) and 3.1.11 (released Jul 30, 2025, the day of disclosure).
The latest release, 4.1.3, is not affected.
- CVE-2025-27598High 7.5
Out-of-bounds Write in SixLabors ImageSharp
Affected: from 3.0.0, fixed in 3.1.7; fixed in 2.1.10.
Fixed in 2.1.10 (released Mar 6, 2025, the day of disclosure) and 3.1.7 (released Mar 6, 2025, the day of disclosure).
The latest release, 4.1.3, is not affected.
- CVE-2024-41132Medium 5.3
SixLabors ImageSharp Allows Excessive Memory Allocation in Gif Decoder
Affected: fixed in 2.1.9; from 3.0.0, fixed in 3.1.5.
Fixed in 2.1.9 (released Jul 22, 2024, the day of disclosure) and 3.1.5 (released Jul 22, 2024, the day of disclosure).
The latest release, 4.1.3, is not affected.
- CVE-2024-41131High 7.5
Out-of-bounds Write in SixLabors ImageSharp
Affected: fixed in 2.1.9; from 3.0.0, fixed in 3.1.5.
Fixed in 2.1.9 (released Jul 22, 2024, the day of disclosure) and 3.1.5 (released Jul 22, 2024, the day of disclosure).
The latest release, 4.1.3, is not affected.
- CVE-2024-32036Medium 5.3
SixLabors.ImageSharp vulnerable to data leakage
Affected: fixed in 2.1.8; from 3.0.0, fixed in 3.1.4.
Fixed in 2.1.8 (released Apr 11, 2024, 4 days before disclosure) and 3.1.4 (released Apr 11, 2024, 4 days before disclosure).
The latest release, 4.1.3, is not affected.
- CVE-2024-32035Medium 5.3
Memory Allocation with Excessive Size Value in SixLabors.ImageSharp
Affected: fixed in 2.1.8; from 3.0.0, fixed in 3.1.4.
Fixed in 2.1.8 (released Apr 11, 2024, 4 days before disclosure) and 3.1.4 (released Apr 11, 2024, 4 days before disclosure).
The latest release, 4.1.3, is not affected.
- CVE-2024-27929High 7.1
Use After Free in SixLabors.ImageSharp
Affected: from 3.0.0, fixed in 3.1.3; fixed in 2.1.7.
Fixed in 2.1.7 (released Mar 6, 2024, 1 day after disclosure) and 3.1.3 (released Mar 5, 2024, the day of disclosure).
The latest release, 4.1.3, is not affected.