CVE-2026-106115: ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
(updated )
The TIFF CCITT Group 4 (T6) encoder writes beyond its logical compressed-data buffer when encoding a 1-bit image. A valid 1×1 Group 4 TIFF decoded and re-encoded with the default TiffEncoder terminates the process with an unhandled exception.
References
- github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95
- github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019
- github.com/SixLabors/ImageSharp/pull/3187
- github.com/SixLabors/ImageSharp/pull/3208
- github.com/SixLabors/ImageSharp/releases/tag/v3.2.0
- github.com/SixLabors/ImageSharp/releases/tag/v4.1.2
- github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w
- github.com/advisories/GHSA-jjfr-hcj7-qf5w
- nvd.nist.gov/vuln/detail/CVE-2026-106115
Code Behaviors & Features
Detect and mitigate CVE-2026-106115 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →