AIKIDO-2026-302378
SixLabors.ImageSharp is vulnerable to Out-of-Bounds Write
55
CVE Score
Medium
Out-of-Bounds Write
TL;DR
When ICC conversion is enabled, ImageSharp's LUT16 calculators store intermediate color values in a four-float Vector4. The ICC parser still accepts up to 15 CLUT output channels, so a malformed embedded LUT16 A2B0 profile that declares more than four output channels makes ClutCalculator.Calculate and LutEntryCalculator.CalculateLut write past that Vector4. Decoding such an image with DecoderOptions.ColorProfileHandling set to Convert corrupts memory and can terminate the process. The default Preserve handling does not run this conversion. The fix rejects ICC conversion profiles with more than four input or output channels before they reach the calculators.
How do I fix this?
Upgrade the SixLabors.ImageSharp library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you decode images that embed an ICC color profile with DecoderOptions.ColorProfileHandling set to Convert.
Package
Versions
4.0.0 - 4.1.1
Fixed in 4.1.2Background info
SixLabors.ImageSharp is vulnerable to Out-of-Bounds Write in versions 4.0.0 - 4.1.1.
Links
GitHub Release
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.