CVE-2026-106112: ImageSharp: ICC LUT16 output channel count can write beyond Vector4
When ICC conversion is enabled, a malformed embedded ICC LUT16 profile with
more than four output channels can corrupt memory during ImageSharp color
conversion. The ICC parser accepts up to 15 CLUT output channels, while the
conversion implementation stores intermediate values in Vector4.
References
- github.com/SixLabors/ImageSharp/commit/b03f0ed7e5be760eecc740fa53dd166b18ae9b23
- github.com/SixLabors/ImageSharp/pull/3187
- github.com/SixLabors/ImageSharp/releases/tag/v4.1.2
- github.com/SixLabors/ImageSharp/security/advisories/GHSA-ffp7-56pq-64mr
- github.com/advisories/GHSA-ffp7-56pq-64mr
- nvd.nist.gov/vuln/detail/CVE-2026-106112
Code Behaviors & Features
Detect and mitigate CVE-2026-106112 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →