ImageSharp EUVD-2026-93557

Requires the host application (using SixLabors ImageSharp 2.1.0 through 4.1.1) to run a decode-and-re-encode flow on attacker-supplied images where TiffCompression.CcittGroup4Fax and one-bit (bilevel) metadata are inherited from the input, so the TIFF CCITT Group 4 (T6) encoder path is reached. The under-allocation is Width×rowsPerStrip bytes, overflowed by encoded row data plus two 12-bit end-of-facsimile-block codes. Limiting factors: the application must actually re-encode images to TIFF G4 (not merely decode or display them); impact is confined to availability (process termination), with no confidentiality or integrity effect; versions 4.1.2 and later are not affected.

This is a genuine but bounded availability (DoS) issue rather than a critical code-execution priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects a remotely reachable, unauthenticated, low-complexity flaw whose only impact is availability - the out-of-bounds write corrupts memory and terminates the process, with C:N/I:N meaning no confirmed confidentiality or integrity loss. Although CWE-787 (out-of-bounds write) can sometimes enable code execution, the vendor advisory and description scope the realistic outcome to memory corruption and process crash, and the CVSS explicitly rates C/I as none; do NOT assume RCE from the CWE alone. No EPSS score, CISA KEV listing, or public POC was provided, so exploitation status is 'no public exploit identified at time of analysis' - there is no evidence of active exploitation or weaponization. A key limiting factor tempers the AV:N/AC:L signal: exploitation requires the host application to perform a decode-and-re-encode flow that inherits TIFF CcittGroup4Fax compression and one-bit metadata from attacker input, which is a narrower condition than the raw vector implies. Verdict: patch in routine cycles - real and remotely triggerable, but availability-only and dependent on a specific re-encode code path.

An attacker uploads a crafted one-bit TIFF image with CCITT Group 4 (T6) fax compression to a .NET web service that uses ImageSharp (2.1.0-4.1.1) to decode and re-encode user images. During re-encode, T6BitCompressor.CompressStrip emits encoded rows plus two 12-bit end-of-facsimile-block codes beyond the under-allocated Width×rowsPerStrip buffer, and TiffCcittCompressor.WriteCode's unchecked writes corrupt memory and crash the process. No public exploit code is identified, but the attack requires no authentication or user interaction once such a re-encode flow is exposed.