ImageSharp CVE-2026-106118

Exploitation requires the target application to decode an attacker-supplied TIFF that is (1) tiled and (2) uses CCITT fax compression - specifically T4, T6, or Modified Huffman - with (3) a TileWidth strictly smaller than ImageWidth; this mismatch is the precise trigger because TiffDecoderCore sizes the destination buffer by TileWidth while TiffDecompressorsFactory.Create constructs the decompressor with the full frame width. Limiting factors: the strip-decoding path is unaffected (this is a distinct tiled-path bug), and the application must actually invoke TIFF decoding on untrusted input. No authentication or user interaction is required per the CVSS vector (PR:N/UI:N), and no special configuration is needed beyond accepting and decoding untrusted images on a vulnerable version (3.0.0-4.1.0).

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, low-complexity, unauthenticated flaw whose scored impact is availability-only (A:H) - a denial-of-service via process termination, consistent with CWE-787 heap corruption. A tension worth flagging: the description asserts 'attacker-controlled out-of-bounds writes' and 'heap corruption', which could in principle enable memory-safety abuse beyond a crash, yet the official vector rates C:N/I:N, so confidentiality/integrity impact (and any code-execution path) is NOT confirmed and should not be assumed. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public exploit code was supplied - the GitHub links are the vendor fix (remediation), not a weaponized POC. Overall this is a legitimate, easily-reachable DoS in image-upload pipelines rather than a confirmed RCE; priority is moderate-to-high for services that decode untrusted TIFFs, but the elevated CVSS reflects availability impact, not demonstrated system compromise.

An application that uses ImageSharp (3.0.0-4.1.0) to decode user-supplied images receives a crafted tiled TIFF whose TileWidth is smaller than ImageWidth and which uses CCITT fax compression (T4/T6/Modified Huffman). During tiled decoding, frame-width fax scanlines are directed into the smaller tile-width destination buffer, triggering attacker-controlled out-of-bounds heap writes that corrupt memory and terminate the process. No public exploit code exists at time of analysis; only the vendor patch is published.