GHSA-FFP7-56PQ-64MR ImageSharp: ICC LUT16 output channel count can write beyond Vector4

Summary When ICC conversion is enabled, a malformed embedded ICC LUT16 profile with more than four output channels can corrupt memory during ImageSharp color conversion. The ICC parser accepts up to 15 CLUT output channels, while the conversion implementation stores intermediate values in Vector4...

CVE-2026-106112

The ImageSharp 2D graphics library (versions 4.0.0 through 4.1.2 ) is vulnerable to an out-of-bounds write (CWE-787) during ICC LUT16 conversion. The root cause is that ClutCalculator.Calculate and LutEntryCalculator.CalculateLut use a Vector4 to store intermediate and output values, but the conv...