CVE-2026-106116: ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop
(updated )
SixLabors.ImageSharp 4.1.1 can spend an attacker-controlled duration decoding a
small malformed BigTIFF. The BigTIFF IFD entry-count field is 64-bit. The reader
iterates once per declared entry, but when fewer than 20 bytes remain for an entry,
the entry read returns without advancing. A 24-byte input can therefore run billions
of iterations without consuming input.
One decoder invocation occupied one executing thread for more than five seconds in the tested environment. This report makes no worker-pool exhaustion claim.
References
- github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec
- github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019
- github.com/SixLabors/ImageSharp/pull/3187
- github.com/SixLabors/ImageSharp/pull/3208
- github.com/SixLabors/ImageSharp/releases/tag/v3.2.0
- github.com/SixLabors/ImageSharp/releases/tag/v4.1.2
- github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g
- github.com/advisories/GHSA-wmxv-xphr-5c9g
- nvd.nist.gov/vuln/detail/CVE-2026-106116
Code Behaviors & Features
Detect and mitigate CVE-2026-106116 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →