CVE-2026-106115: 
C# vulnerability analysis and mitigation

CVE-2026-106115 is an out-of-bounds write vulnerability in SixLabors ImageSharp, a .NET 2D graphics library, affecting the TIFF CCITT Group 4 (T6) encoder. The flaw exists in versions 2.1.0 through 4.1.1 (inclusive) of the SixLabors.ImageSharp NuGet package and was disclosed on September 15, 2026, with a fix released in version 4.1.2. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause (CWE-787: Out-of-bounds Write) lies in TiffCcittCompressor.Initialize, which allocates only Width × rowsPerStrip bytes for the compressed output buffer. However, T6BitCompressor.CompressStrip can emit encoded row data plus two 12-bit end-of-facsimile-block (EOFB) codes that exceed this allocation, and TiffCcittCompressor.WriteCode performs these writes without checking destination capacity. An attacker can exploit this remotely with no authentication or user interaction by supplying a crafted 1-bit TIFF image encoded with CcittGroup4Fax compression; when an application decodes and re-encodes it using the default TiffEncoder, the inherited TiffCompression.CcittGroup4Fax and 1-bit metadata trigger the unsafe encoder path. The fix (commit a9498c6) introduces a GetMaximumEncodedBits abstract method to correctly size the output buffer and adds a bounds check inside WriteCode (GitHub Advisory, Fix Commit).

Successful exploitation causes memory corruption and unhandled process termination (ArgumentOutOfRangeException after unchecked out-of-bounds writes), resulting in a denial-of-service condition for any application that decodes and re-encodes attacker-supplied TIFF images. There is no known confidentiality or integrity impact — the CVSS assessment reflects a High availability impact with no confidentiality or integrity loss. Applications performing image transcoding pipelines (e.g., web services, document processors) that accept user-supplied TIFF files are most at risk (GitHub Advisory).

No active in-the-wild exploitation is known, and no public proof-of-concept exploit code has been published beyond the reproduction case included in the security advisory itself. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.35%, indicating a low probability of near-term exploitation. The attack requires no privileges or user interaction, making it trivially triggerable against any exposed image-processing endpoint that accepts TIFF input (GitHub Advisory, Feedly).

1. Craft a malicious TIFF: Create or obtain a minimal 1×1 pixel TIFF image encoded with CCITT Group 4 (T6) compression and 1-bit-per-pixel metadata. The advisory provides a base64-encoded example payload that can be decoded directly.
2. Identify a vulnerable target: Find an application using SixLabors.ImageSharp versions 2.1.0–4.1.1 that accepts TIFF image uploads and performs a decode-then-re-encode operation (e.g., image conversion, thumbnail generation, or format normalization).
3. Submit the crafted TIFF: Upload or send the malicious TIFF to the target application's image-processing endpoint.
4. Trigger the vulnerable code path: The application decodes the TIFF, inheriting TiffCompression.CcittGroup4Fax and 1-bit metadata from the frame, then re-encodes it using the default TiffEncoder.
5. Achieve denial of service: T6BitCompressor.CompressStrip writes two 12-bit EOFB codes beyond the undersized one-byte buffer; the subsequent slice check throws an unhandled ArgumentOutOfRangeException, terminating the host process (GitHub Advisory).

• Logs: Unhandled exception entries in application logs referencing System.ArgumentOutOfRangeException at SixLabors.ImageSharp.Formats.Tiff.Compression.Compressors.TiffCcittCompressor.CompressStrip; repeated process crash/restart events in service logs.
• Network: Unusual uploads of small TIFF files (potentially as small as ~120 bytes) to image-processing endpoints, particularly files with CcittGroup4Fax compression metadata.
• Process: Unexpected termination (exit code 134 on Linux) of the .NET application process hosting ImageSharp; crash dump files generated by the runtime corresponding to ArgumentOutOfRangeException in the TIFF encoder stack (GitHub Advisory).

Upgrade SixLabors.ImageSharp to version 4.1.2 or later, which correctly sizes CCITT encoder output buffers and adds bounds checks in WriteCode. No configuration-based workaround is available for versions 2.1.0–4.1.1; the only mitigation short of upgrading is to reject or sanitize TIFF inputs with CcittGroup4Fax compression before passing them to the encoder. Note that the fix is only available in the 4.x branch — users on the 3.x or 2.x series must upgrade to 4.1.2 (GitHub Release, Fix PR).

The vulnerability was reported by security researcher MegaManSec and acknowledged by the SixLabors maintainer (JimBobSquarePants), who merged a comprehensive hardening PR (#3187) addressing this and multiple other codec input validation issues. The fix was incorporated into the v4.1.2 release on September 14, 2026. Community reaction has been largely focused on dependency update pull requests across numerous downstream projects, indicating broad adoption of the patched version (GitHub Advisory, Fix PR).