---
id: CVE-2026-106112
title: ImageSharp is a 2D graphics library
summary: >-
  ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ICC LUT16
  conversion accepts more than four output channels even though
  ClutCalculator.Calculate and LutEntryCalculator.CalculateLut store
  intermediate and output values in Vec…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-787
vendor: SixLabors
product: ImageSharp
affected:
  - 'ImageSharp >= 4.0.0, < 4.1.2'
published: '2026-10-06'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T20:03:40.690'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106112'
references:
  - url: >-
      https://github.com/SixLabors/ImageSharp/commit/b03f0ed7e5be760eecc740fa53dd166b18ae9b23
    label: security-advisories@github.com
  - url: 'https://github.com/SixLabors/ImageSharp/pull/3187'
    label: security-advisories@github.com
  - url: 'https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2'
    label: security-advisories@github.com
  - url: >-
      https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-ffp7-56pq-64mr
    label: security-advisories@github.com
  - url: >-
      https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-ffp7-56pq-64mr
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106112'
  - url: 'https://github.com/advisories/GHSA-ffp7-56pq-64mr'
tags:
  - nvd
  - cve.org
  - ghsa
  - nuget
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-06T18:21:59.947801Z'
ingestedAt: '2026-10-06T18:11:36.228Z'
aliases:
  - GHSA-ffp7-56pq-64mr
ecosystem: nuget
patched:
  - SixLabors.ImageSharp 4.1.2
---

## Overview

ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ICC LUT16 conversion accepts more than four output channels even though ClutCalculator.Calculate and LutEntryCalculator.CalculateLut store intermediate and output values in Vector4. When DecoderOptions.ColorProfileHandling is set to Convert, a malformed embedded profile can direct interpolation and output-LUT operations to write one float per declared channel beyond the four-float destination. This can corrupt memory and terminate the process; the default Preserve mode does not run ICC conversion. This issue is fixed in version 4.1.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-106112)

Affected packages:

- `SixLabors.ImageSharp >= 4.0.0, <= 4.1.1`

Patched in:

- `SixLabors.ImageSharp 4.1.2`

Source: https://github.com/advisories/GHSA-ffp7-56pq-64mr