CVE-2026-106114: ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions
(updated )
A malformed embedded ICC profile can make ImageSharp allocate memory from attacker-controlled CLUT channel and grid dimensions before verifying that the declared CLUT values are present.
In published v1 through v3 packages, the public lazy ICC parser allocates approximately 115 MB from the 200-byte test profile before rejecting the truncated tag. In published v4 packages, decoding with ICC conversion enabled requests an 860,934,420-byte managed float array from the same profile.
References
- github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df
- github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019
- github.com/SixLabors/ImageSharp/pull/3187
- github.com/SixLabors/ImageSharp/pull/3208
- github.com/SixLabors/ImageSharp/releases/tag/v3.2.0
- github.com/SixLabors/ImageSharp/releases/tag/v4.1.2
- github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44
- github.com/advisories/GHSA-gwg2-r3hj-4w44
- nvd.nist.gov/vuln/detail/CVE-2026-106114
Code Behaviors & Features
Detect and mitigate CVE-2026-106114 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →