ImageSharp CVE-2026-106117

Exploitation requires the target application to decode an attacker-supplied TIFF that uses strip (non-tiled) organization with CCITT Group 3 (T4) or Modified Huffman compression, processed by ImageSharp versions 3.0.0 through 4.1.0; the malicious run must use makeup codes that expand beyond the current row width so the write occurs before the (previously missing) width validation. Limiting factors: the application must accept and decode untrusted TIFF input, and the file must specifically use these CCITT/MH strip code paths (the tiled decompressor-width mismatch is a separate issue). No authentication (PR:N) or user interaction (UI:N) is required on the target, but the realistic impact is a process crash/DoS, not confidentiality or integrity loss.

All available signals converge on this being a genuine but availability-only (denial-of-service) issue rather than a code-execution emergency. The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw whose only impact is A:H - consistent with the description's end state of heap corruption that 'terminates the process.' There is no confidentiality or integrity impact claimed, so despite the CWE-787 out-of-bounds write and 'Memory Corruption' tags, the vendor advisory frames the realistic outcome as a crash, not arbitrary code execution. No EPSS score was supplied and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation; no public exploit/POC is referenced either. The net picture is a credible, easily-triggered DoS against any .NET service that decodes untrusted TIFFs, but no confirmed in-the-wild activity. Note one caveat: EPSS and KEV data are simply absent from the input (not low), so exploitation probability cannot be quantified - absence should not be read as 'safe,' only as 'unmeasured.'

An attacker uploads or submits a malicious TIFF image to a .NET web application or service that uses ImageSharp 3.0.0-4.1.0 to decode or thumbnail user-supplied images. The crafted strip TIFF uses CCITT Group 3 or Modified Huffman compression with an oversized makeup-code run that exceeds the row width, causing an unchecked write past the strip buffer that corrupts the heap and crashes the process. No public exploit code is identified, but the trigger is a single malformed file requiring no authentication or user interaction on the target.