ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop

Summary SixLabors.ImageSharp 4.1.1 can spend an attacker-controlled duration decoding a small malformed BigTIFF. The BigTIFF IFD entry-count field is 64-bit. The reader iterates once per declared entry, but when fewer than 20 bytes remain for an entry, the entry read returns without advancing. A...

GHSA-WMXV-XPHR-5C9G ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop

Summary SixLabors.ImageSharp 4.1.1 can spend an attacker-controlled duration decoding a small malformed BigTIFF. The BigTIFF IFD entry-count field is 64-bit. The reader iterates once per declared entry, but when fewer than 20 bytes remain for an entry, the entry read returns without advancing. A...

EUVD-2026-93559

ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop...

CVE-2026-106116

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without advancing the stream or terminating the outer loop, so a sma...

CVE-2026-106116 ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without advancing the stream or terminating the outer loop, so a sma...

CVE-2026-106116

The ImageSharp 2D graphics library versions 2.0.0 through 4.1.2 are vulnerable to a non-progressing loop when processing malformed BigTIFF files. The root cause is located in ExifReader.ReadValues64 , which trusts the 64-bit BigTIFF IFD entry count and iterates accordingly. When fewer than 20 byt...

CVE-2026-106116 ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without advancing the stream or terminating the outer loop, so a sma...

CVE-2026-106116 ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without advancing the stream or terminating the outer loop, so a sma...

CVE-2026-106116: Loop with Unreachable Exit Condition

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without advancing the stream or terminating the outer loop, so a sma...

PT-2026-106833

Name of the Vulnerable Software and Affected Versions ImageSharp versions 2.0.0 through 4.1.1 Description ImageSharp is a 2D graphics library. The ExifReader.ReadValues64 function trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. If fewer than 20 bytes remain, the...

OESA-2026-4063 libtiff security update

This provides support for the Tag Image File Format TIFF, a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff...

SUSE CVE-2026-18495

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit...

Linux Distros Unpatched Vulnerability : CVE-2026-18495

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted...

DEBIAN-CVE-2026-18495

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit...

CVE-2026-18495

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit...

UBUNTU-CVE-2026-18495

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit...

CVE-2026-18495

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit...

CVE-2026-18495

CVE-2026-18495 is a heap-buffer overflow in the tiff2pdf utility within libtiff , triggered by an integer truncation error when processing a crafted BigTIFF file. A 64-bit StripByteCounts value is truncated to 32 bits, causing an undersized memory allocation followed by an out-of-bounds copy, lea...

CVE-2026-18495

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit...

EUVD-2026-76166

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit...