Medium severity · published Apr 15, 2024
CVE-2024-32035
ImageSharp is a 2D graphics API
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in image decoders. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw. This flaw can be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on ImageSharp for image processing tasks. Users and administrators are advised to update to the latest version of ImageSharp that addresses this vulnerability to mitigate the risk of exploitation. The problem has been patched in v3.1.4 and v2.1.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Imagesharp · Sixlabors
before 2.1.8; 3.0.0 before 3.1.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-32035
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-32035
Product
https://docs.sixlabors.com/articles/imagesharp.web/processingcommands.html#securing-processing-commands
Product
https://docs.sixlabors.com/articles/imagesharp/security.html
Patch
https://github.com/SixLabors/ImageSharp/commit/b6b08ac3e7cea8da5ac1e90f7c0b67dd254535c3
Patch
https://github.com/SixLabors/ImageSharp/commit/f21d64188e59ae9464ff462056a5e29d8e618b27
Vendor Advisory
https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-g85r-6x2q-45w7
More from Imagesharp
7.5
CVE-2026-106118
ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write
7.5
CVE-2026-106117
ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp
7.5
CVE-2026-106115
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
7.5
CVE-2026-106113
ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index
7.5
CVE-2026-106112
ImageSharp: ICC LUT16 output channel count can write beyond Vector4
