SixLabors.ImageSharp Known Vulnerabilities & Fixes
SixLabors.ImageSharp has 12 known security vulnerabilities in NuGet (.NET). Upgrade to version 4.1.2 or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.
Low Immediate Risk
No actively exploited vulnerabilities detected. Monitor and update in your next maintenance window.
Recommended safe version: 4.1.2
Upgrading to 4.1.2 or later resolves all 12 known vulnerabilities in SixLabors.ImageSharp. Run: dotnet add package SixLabors.ImageSharp --version 4.1.2
Is SixLabors.ImageSharp in your project?
Check if you're affected and upgrade to 4.1.2 to stay secure.
Security Summary
- 19 affected version ranges have been identified across these 12 advisories.
- 100% of known issues have a published fixed version.
- Remediation: dotnet add package SixLabors.ImageSharp
Vulnerabilities
12 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details. First disclosed Mar 5, 2024, most recently Oct 7, 2026 (946 days apart).
| CVE / GHSA | Severity | Affected | Fixed In |
|---|---|---|---|
| CVE-2026-106115 ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer | HIGH | 2.1.0, 2.1.1, 2.1.10, 2.1.11 (+29 more) | 4.1.2 |
| CVE-2026-106112 ImageSharp: ICC LUT16 output channel count can write beyond Vector4 | HIGH | 4.0.0, 4.1.0, 4.1.1 | 4.1.2 |
| CVE-2026-106110 ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer | HIGH | 2.0.0, 2.1.0, 2.1.1, 2.1.10 (+30 more) | 4.1.2 |
| CVE-2026-106113 ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index | HIGH | 2.0.0, 2.1.0, 2.1.1, 2.1.10 (+30 more) | 4.1.2 |
| CVE-2025-27598 Out-of-bounds Write in SixLabors ImageSharp | HIGH | 3.0.0, 3.0.1, 3.0.2, 3.1.0 (+32 more) | 3.1.7, 2.1.10 |
| CVE-2024-41131 SixLabors ImageSharp Out-of-bounds Write | HIGH | 1.0.0, 1.0.0-beta0001, 1.0.0-beta0002, 1.0.0-beta0003 (+29 more) | 2.1.9, 3.1.5 |
| CVE-2024-27929 Use After Free in SixLabors.ImageSharp | HIGH | 3.0.0, 3.0.1, 3.0.2, 3.1.0 (+25 more) | 3.1.3, 2.1.7 |
| CVE-2025-54575 SixLabors ImageSharp Has Infinite Loop in GIF Decoder When Skipping Malformed Comment Extension Blocks | MEDIUM | 1.0.0, 1.0.0-beta0001, 1.0.0-beta0002, 1.0.0-beta0003 (+37 more) | 2.1.11, 3.1.11 |
| CVE-2024-41132 SixLabors ImageSharp has Excessive Memory Allocation in Gif Decoder | MEDIUM | 1.0.0, 1.0.0-beta0001, 1.0.0-beta0002, 1.0.0-beta0003 (+29 more) | 2.1.9, 3.1.5 |
| CVE-2024-32036 SixLabors.ImageSharp vulnerable to data leakage | MEDIUM | 1.0.0, 1.0.0-beta0001, 1.0.0-beta0002, 1.0.0-beta0003 (+27 more) | 2.1.8, 3.1.4 |
| CVE-2024-32035 SixLabors.ImageSharp vulnerable to Memory Allocation with Excessive Size Value | MEDIUM | 1.0.0, 1.0.0-beta0001, 1.0.0-beta0002, 1.0.0-beta0003 (+27 more) | 2.1.8, 3.1.4 |
| CVE-2026-106111 ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate | MEDIUM | 4.0.0, 4.1.0, 4.1.1 | 4.1.2 |
About This Data
Vulnerability data for SixLabors.ImageSharp is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.
CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
Related NuGet (.NET) Packages
Other packages in this ecosystem, ranked by shared vulnerabilities where available.
Check Your Dependencies
Scan your project to check if you're using a vulnerable version of SixLabors.ImageSharp.