High severity · published Jul 22, 2024
CVE-2024-41132
ImageSharp is a 2D graphics API
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in the Gif decoder. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw. All users are advised to upgrade to v3.1.5 or v2.1.9.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Imagesharp · Sixlabors
2.1.0 before 2.1.9; 3.1.0 before 3.1.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-41132
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-41132
Product
https://docs.sixlabors.com/articles/imagesharp.web/processingcommands.html#securing-processing-commands
Product
https://docs.sixlabors.com/articles/imagesharp/security.html
Patch
https://github.com/SixLabors/ImageSharp/commit/59de13c8cc47f2b402e2c43aa7024511d029d515
Patch
https://github.com/SixLabors/ImageSharp/commit/9816ca45016c5d3859986f3c600e8934bc450a56
Patch
https://github.com/SixLabors/ImageSharp/commit/b496109051cc39feee1f6cde48fca6481de17f9a
Issue Tracking
https://github.com/SixLabors/ImageSharp/pull/2759
More from Imagesharp
7.5
CVE-2026-106118
ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write
7.5
CVE-2026-106117
ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp
7.5
CVE-2026-106115
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
7.5
CVE-2026-106113
ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index
7.5
CVE-2026-106112
ImageSharp: ICC LUT16 output channel count can write beyond Vector4