# SixLabors.ImageSharp (NuGet) vulnerabilities 15 known vulnerabilities (8 high, 7 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.1.3 (Oct 9, 2026): no advisory affects it - Newest unaffected release: 4.1.3 (Oct 9, 2026), the latest release - Releases: 52 since 1.0.0 (Aug 4, 2020) - Registry: https://www.nuget.org/packages/SixLabors.ImageSharp - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-106118: 3.0.0 to 3.1.12 (3.2.0 is outside it); 4.0.0 to 4.1.0 (4.1.1 is outside it) - CVE-2026-106116: 2.0.0 to 4.1.1 (4.1.2 is outside it) - CVE-2026-106115: 2.1.0 to 4.1.1 (4.1.2 is outside it) - CVE-2026-106114: 1.0.0-beta0001 to 3.1.12 (3.2.0 is outside it); 4.0.0 to 4.1.1 (4.1.2 is outside it) - CVE-2026-106113: 2.0.0 to 4.1.1 (4.1.2 is outside it) - CVE-2026-106112: 4.0.0 to 4.1.1 (4.1.2 is outside it) - CVE-2026-106111: 4.0.0 to 4.1.1 (4.1.2 is outside it) - CVE-2026-106110: 2.0.0 to 4.1.1 (4.1.2 is outside it) - CVE-2025-54575: 1.0.0-beta0001 to 2.1.10 (2.1.11 is outside it); 3.0.0 to 3.1.10 (3.1.11 is outside it) - CVE-2025-27598: 1.0.0-beta0001 to 2.1.9 (2.1.10 is outside it); 3.0.0 to 3.1.6 (3.1.7 is outside it) - CVE-2024-41132: 1.0.0-beta0001 to 2.1.8 (2.1.9 is outside it); 3.0.0 to 3.1.4 (3.1.5 is outside it) - CVE-2024-41131: 1.0.0-beta0001 to 2.1.8 (2.1.9 is outside it); 3.0.0 to 3.1.4 (3.1.5 is outside it) - CVE-2024-32036: 1.0.0-beta0001 to 2.1.7 (2.1.8 is outside it); 3.0.0 to 3.1.3 (3.1.4 is outside it) - CVE-2024-32035: 1.0.0-beta0001 to 2.1.7 (2.1.8 is outside it); 3.0.0 to 3.1.3 (3.1.4 is outside it) - CVE-2024-27929: 1.0.0-beta0001 to 2.1.6 (2.1.7 is outside it); 3.0.0 to 3.1.2 (3.1.3 is outside it) ## Advisories (15) ### [CVE-2026-106118](https://cve.now/CVE-2026-106118): ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write - Severity: High 7.5 - Published: Oct 6, 2026 - Affected: from 3.0.0, fixed in 3.2.0; from 4.0.0, fixed in 4.1.1. - Fixed in 3.2.0 (released Oct 9, 2026, 3 days after disclosure) and 4.1.1 (released Aug 20, 2026, 47 days before disclosure). - The latest release, 4.1.3, is not affected. ### [CVE-2026-106116](https://cve.now/CVE-2026-106116): ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop - Severity: Medium 5.3 - Published: Oct 6, 2026 - Affected: from 2.0.0, fixed in 4.1.2. - Fixed in 4.1.2 (released Sep 14, 2026, 22 days before disclosure). - The latest release, 4.1.3, is not affected. ### [CVE-2026-106115](https://cve.now/CVE-2026-106115): ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer - Severity: High 7.5 - Published: Oct 6, 2026 - Affected: from 2.1.0, fixed in 4.1.2. - Fixed in 4.1.2 (released Sep 14, 2026, 22 days before disclosure). - The latest release, 4.1.3, is not affected. ### [CVE-2026-106114](https://cve.now/CVE-2026-106114): ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions - Severity: Medium 5.3 - Published: Oct 6, 2026 - Affected: from 4.0.0, fixed in 4.1.2; from 1.0.0-beta0001, fixed in 3.2.0. - Fixed in 3.2.0 (released Oct 9, 2026, 3 days after disclosure) and 4.1.2 (released Sep 14, 2026, 22 days before disclosure). - The latest release, 4.1.3, is not affected. ### [CVE-2026-106113](https://cve.now/CVE-2026-106113): ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index - Severity: High 7.5 - Published: Oct 6, 2026 - Affected: from 2.0.0, fixed in 4.1.2. - Fixed in 4.1.2 (released Sep 14, 2026, 22 days before disclosure). - The latest release, 4.1.3, is not affected. ### [CVE-2026-106112](https://cve.now/CVE-2026-106112): ImageSharp: ICC LUT16 output channel count can write beyond Vector4 - Severity: High 7.5 - Published: Oct 6, 2026 - Affected: from 4.0.0, fixed in 4.1.2. - Fixed in 4.1.2 (released Sep 14, 2026, 22 days before disclosure). - The latest release, 4.1.3, is not affected. ### [CVE-2026-106111](https://cve.now/CVE-2026-106111): ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate - Severity: Medium 5.9 - Published: Oct 6, 2026 - Affected: from 4.0.0, fixed in 4.1.2. - Fixed in 4.1.2 (released Sep 14, 2026, 22 days before disclosure). - The latest release, 4.1.3, is not affected. ### [CVE-2026-106110](https://cve.now/CVE-2026-106110): ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer - Severity: High 7.5 - Published: Oct 6, 2026 - Affected: from 2.0.0, fixed in 4.1.2. - Fixed in 4.1.2 (released Sep 14, 2026, 22 days before disclosure). - The latest release, 4.1.3, is not affected. ### [CVE-2025-54575](https://cve.now/CVE-2025-54575): ImageSharp Triggers an Infinite Loop in its GIF Decoder When Skipping Malformed Comment Extension Blocks - Severity: Medium 5.3 - Published: Jul 30, 2025 - Affected: fixed in 2.1.11; from 3.0.0, fixed in 3.1.11. - Fixed in 2.1.11 (released Jul 30, 2025, the day of disclosure) and 3.1.11 (released Jul 30, 2025, the day of disclosure). - The latest release, 4.1.3, is not affected. ### [CVE-2025-27598](https://cve.now/CVE-2025-27598): Out-of-bounds Write in SixLabors ImageSharp - Severity: High 7.5 - Published: Mar 6, 2025 - Affected: from 3.0.0, fixed in 3.1.7; fixed in 2.1.10. - Fixed in 2.1.10 (released Mar 6, 2025, the day of disclosure) and 3.1.7 (released Mar 6, 2025, the day of disclosure). - The latest release, 4.1.3, is not affected. ### [CVE-2024-41132](https://cve.now/CVE-2024-41132): SixLabors ImageSharp Allows Excessive Memory Allocation in Gif Decoder - Severity: Medium 5.3 - Published: Jul 22, 2024 - Affected: fixed in 2.1.9; from 3.0.0, fixed in 3.1.5. - Fixed in 2.1.9 (released Jul 22, 2024, the day of disclosure) and 3.1.5 (released Jul 22, 2024, the day of disclosure). - The latest release, 4.1.3, is not affected. ### [CVE-2024-41131](https://cve.now/CVE-2024-41131): Out-of-bounds Write in SixLabors ImageSharp - Severity: High 7.5 - Published: Jul 22, 2024 - Affected: fixed in 2.1.9; from 3.0.0, fixed in 3.1.5. - Fixed in 2.1.9 (released Jul 22, 2024, the day of disclosure) and 3.1.5 (released Jul 22, 2024, the day of disclosure). - The latest release, 4.1.3, is not affected. ### [CVE-2024-32036](https://cve.now/CVE-2024-32036): SixLabors.ImageSharp vulnerable to data leakage - Severity: Medium 5.3 - Published: Apr 15, 2024 - Affected: fixed in 2.1.8; from 3.0.0, fixed in 3.1.4. - Fixed in 2.1.8 (released Apr 11, 2024, 4 days before disclosure) and 3.1.4 (released Apr 11, 2024, 4 days before disclosure). - The latest release, 4.1.3, is not affected. ### [CVE-2024-32035](https://cve.now/CVE-2024-32035): Memory Allocation with Excessive Size Value in SixLabors.ImageSharp - Severity: Medium 5.3 - Published: Apr 15, 2024 - Affected: fixed in 2.1.8; from 3.0.0, fixed in 3.1.4. - Fixed in 2.1.8 (released Apr 11, 2024, 4 days before disclosure) and 3.1.4 (released Apr 11, 2024, 4 days before disclosure). - The latest release, 4.1.3, is not affected. ### [CVE-2024-27929](https://cve.now/CVE-2024-27929): Use After Free in SixLabors.ImageSharp - Severity: High 7.1 - Published: Mar 5, 2024 - Affected: from 3.0.0, fixed in 3.1.3; fixed in 2.1.7. - Fixed in 2.1.7 (released Mar 6, 2024, 1 day after disclosure) and 3.1.3 (released Mar 5, 2024, the day of disclosure). - The latest release, 4.1.3, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/nuget/sixlabors.imagesharp Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.