Vulnerability Details CVE-2026-106113
ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process termination. Adaptive Histogram Equalization and AutoLevel are not affected by this report. This issue is fixed in version 4.1.2.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 29.1%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2026-106113
-
cpe:2.3:a:sixlabors:imagesharp:2.0.0
-
cpe:2.3:a:sixlabors:imagesharp:2.1.0
-
cpe:2.3:a:sixlabors:imagesharp:2.1.1
-
cpe:2.3:a:sixlabors:imagesharp:2.1.10
-
cpe:2.3:a:sixlabors:imagesharp:2.1.11
-
cpe:2.3:a:sixlabors:imagesharp:2.1.2
-
cpe:2.3:a:sixlabors:imagesharp:2.1.3
-
cpe:2.3:a:sixlabors:imagesharp:2.1.4
-
cpe:2.3:a:sixlabors:imagesharp:2.1.5
-
cpe:2.3:a:sixlabors:imagesharp:2.1.6
-
cpe:2.3:a:sixlabors:imagesharp:2.1.7
-
cpe:2.3:a:sixlabors:imagesharp:2.1.8
-
cpe:2.3:a:sixlabors:imagesharp:2.1.9
-
cpe:2.3:a:sixlabors:imagesharp:3.0.0
-
cpe:2.3:a:sixlabors:imagesharp:3.0.1
-
cpe:2.3:a:sixlabors:imagesharp:3.0.2
-
cpe:2.3:a:sixlabors:imagesharp:3.1.0
-
cpe:2.3:a:sixlabors:imagesharp:3.1.1
-
cpe:2.3:a:sixlabors:imagesharp:3.1.10
-
cpe:2.3:a:sixlabors:imagesharp:3.1.11
-
cpe:2.3:a:sixlabors:imagesharp:3.1.12
-
cpe:2.3:a:sixlabors:imagesharp:3.1.2
-
cpe:2.3:a:sixlabors:imagesharp:3.1.3
-
cpe:2.3:a:sixlabors:imagesharp:3.1.4
-
cpe:2.3:a:sixlabors:imagesharp:3.1.5
-
cpe:2.3:a:sixlabors:imagesharp:3.1.6
-
cpe:2.3:a:sixlabors:imagesharp:3.1.7
-
cpe:2.3:a:sixlabors:imagesharp:3.1.8
-
cpe:2.3:a:sixlabors:imagesharp:3.1.9
-
cpe:2.3:a:sixlabors:imagesharp:4.0.0
-
cpe:2.3:a:sixlabors:imagesharp:4.1.0
-
cpe:2.3:a:sixlabors:imagesharp:4.1.1