ImageSharp EUVD-2026-93554

Exploitation requires that the consuming application (1) decode an attacker-supplied 32-bit floating-point TIFF specifically into Image<HalfVector4>, and (2) apply the global HistogramEqualization processor to it, producing a non-finite or out-of-range BT.709 luminance that becomes an unchecked histogram offset. Limiting factors that reduce real-world exposure: Adaptive Histogram Equalization and AutoLevel are explicitly NOT affected, so applications using those variants are safe; the app must actively choose the HalfVector4 pixel type and the equalization step rather than merely accept an upload; and impact is limited to process termination (availability only, no data exposure or code execution). Affected versions are ImageSharp 2.0.0 up to but not including 4.1.2.

The input CVSS is 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), an availability-only impact - process termination (denial of service) with no confidentiality or integrity loss, consistent with CWE-787 out-of-bounds access that crashes rather than achieves code execution. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' The network vector and low attack complexity look alarming in isolation, but the real-world trigger is narrow: it fires only when a consuming application decodes an attacker-supplied 32-bit floating-point TIFF specifically as Image<HalfVector4> AND then applies the global HistogramEqualization processor - Adaptive Histogram Equalization and AutoLevel are explicitly unaffected. This is therefore a conditional DoS, not a broadly exploitable RCE; it is a genuine but moderate priority, higher for services that auto-process untrusted uploads through that exact code path and low for everyone else. Note a significant data conflict: the referenced PR #3187 and commit diff concern ICC color-profile channel-count validation and stream read-range bounds checks, NOT the described TIFF/HalfVector4/GetBT709Luminance histogram-offset path - verify with the vendor advisory (GHSA-j3p4-wp97-rph4) that the linked fix actually addresses this described flaw.

An attacker uploads a crafted 32-bit floating-point TIFF to a .NET service that decodes images as Image<HalfVector4> and runs global HistogramEqualization on them. The non-finite/out-of-range luminance from ColorNumerics.GetBT709Luminance is used as an unchecked histogram offset in GrayscaleLevelsRowOperation.Invoke, causing an out-of-range access that terminates the worker process (denial of service). No public exploit code is identified at time of analysis; remote attackers need no authentication (PR:N) or user interaction, but the application must be using the specific decode-and-equalize path.