CVE-2024-27929 — Use After Free in SixLabors.ImageSharp — CVE Details

HIGH

Use After Free in SixLabors.ImageSharp

Published March 5, 2024Updated September 10, 2026Source: osv

Summary

### Impact A heap-use-after-free flaw was found in ImageSharp's InitializeImage() function of PngDecoderCore.cs file. This vulnerability is triggered when an attacker passes a specially crafted PNG image file to ImageSharp for conversion, potentially leading to information disclosure. ### Patches The problem has been patched. All users are advised to upgrade to v3.1.3 or v2.1.7. ### Workarounds None ### References None

Advisory Timeline

First published March 5, 2024 (951 days ago).
Last revised September 10, 2026 — 918 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

NuGet

Update SixLabors.ImageSharp to 3.1.3 or later

dotnet add package SixLabors.ImageSharp --version 3.1.3

NuGet

Update SixLabors.ImageSharp to 2.1.7 or later

dotnet add package SixLabors.ImageSharp --version 2.1.7

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: nuget (1).

Package	Ecosystem	Affected	Fixed In
SixLabors.ImageSharp	nuget	3.0.0, 3.0.1, 3.0.2, 3.1.0 (+2 more)	3.1.3
SixLabors.ImageSharp	nuget	1.0.0, 1.0.0-beta0001, 1.0.0-beta0002, 1.0.0-beta0003 (+19 more)	2.1.7

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-416
Use After FreeMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.1 score means for each attack dimension.

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

References

Frequently Asked Questions

What is CVE-2024-27929?: Use After Free in SixLabors.ImageSharp This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.1/10).
How do I check if my project is affected by CVE-2024-27929?: CVE-2024-27929 affects SixLabors.ImageSharp. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-27929 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

7.1

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-65x7-c272-7g7r

Related CVEs

CVE-2025-27598
HIGH
Out-of-bounds Write in SixLabors ImageSharp
CVE-2026-106113
HIGH
ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index
CVE-2026-106110
HIGH
ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer
CVE-2026-106115
HIGH
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
CVE-2026-106111
MEDIUM
ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate
CVE-2024-32035
MEDIUM
SixLabors.ImageSharp vulnerable to Memory Allocation with Excessive Size Value
CVE-2024-41132
MEDIUM
SixLabors ImageSharp has Excessive Memory Allocation in Gif Decoder
CVE-2025-54575
MEDIUM
SixLabors ImageSharp Has Infinite Loop in GIF Decoder When Skipping Malformed Comment Extension Blocks

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies