ImageSharp EUVD-2026-93574

Exploitation requires that CCITT Group 3 fax compression (TiffCompression.CcittGroup3Fax) is used during TIFF encoding - either selected explicitly by the host application or inherited automatically from a decoded TIFF's metadata in a decode-and-re-encode flow - AND that the image being encoded is a narrow 1-bit image that triggers the undersized buffer allocation in TiffCcittCompressor.Initialize. Limiting factors that reduce real-world risk: the flaw is in the TIFF *encode* path, so an application that only decodes images is not affected unless it re-encodes; applications that never select CCITT Group 3 compression and never process attacker-supplied TIFF metadata that sets it are not reachable; and the impact is limited to process termination (DoS), not confidentiality or integrity loss. Affected versions are ImageSharp 2.0.0 through 4.1.1.

This is a classic high-CVSS-but-bounded-impact availability flaw rather than a top-tier emergency. The NVD vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5) scores entirely on availability: the CWE-787 out-of-bounds write corrupts process memory and terminates the process (denial of service), with no confidentiality or integrity impact and no indication of code execution despite the 'corrupt process memory' wording. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation - the 7.5 reflects theoretical remote reachability, not demonstrated weaponization. A key conflict to verify: the AV:N/PR:N/AC:L vector implies trivial remote unauthenticated abuse, but the description's exploitation path is conditional - it fires only when TiffCompression.CcittGroup3Fax is selected (either explicitly by the application or inherited from decoded TIFF metadata) and only for narrow 1-bit images, which narrows real-world exposure well below what the raw score suggests. Priority should be moderate: patch promptly where ImageSharp handles untrusted TIFFs in a decode-and-re-encode pipeline, but it is not a drop-everything issue absent exploitation signals.

An application uses ImageSharp (2.0.0-4.1.1) to accept user-uploaded TIFF images and re-encode them, with CCITT Group 3 fax compression either configured or inherited from the uploaded file's metadata. An attacker submits a crafted narrow 1-bit TIFF so that TiffCcittCompressor.Initialize under-allocates the compressed-data buffer and T4BitCompressor.CompressStrip writes past the output span, corrupting memory and crashing the worker process to cause denial of service. No public proof-of-concept was provided in the intelligence sources.