High severity · published Oct 6, 2026
CVE-2026-106112
ImageSharp: ICC LUT16 output channel count can write beyond Vector4
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ICC LUT16 conversion accepts more than four output channels even though ClutCalculator.Calculate and LutEntryCalculator.CalculateLut store intermediate and output values in Vector4. When DecoderOptions.ColorProfileHandling is set to Convert, a malformed embedded profile can direct interpolation and output-LUT operations to write one float per declared channel beyond the four-float destination. This can corrupt memory and terminate the process; the default Preserve mode does not run ICC conversion. This issue is fixed in version 4.1.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
ImageSharp · SixLabors
>= 4.0.0, < 4.1.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-106112
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-106112
x_refsource_CONFIRM
https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-ffp7-56pq-64mr
x_refsource_MISC
https://github.com/SixLabors/ImageSharp/pull/3187
x_refsource_MISC
https://github.com/SixLabors/ImageSharp/commit/b03f0ed7e5be760eecc740fa53dd166b18ae9b23
x_refsource_MISC
https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2
More from ImageSharp
7.5
CVE-2026-106118
ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write
7.5
CVE-2026-106117
ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp
7.5
CVE-2026-106115
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
7.5
CVE-2026-106113
ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index
7.5
CVE-2026-106110
ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer