EUVD-2026-93576

ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate...

CVE-2026-106111: Sensitive Information in Resource Not Removed Before Reuse

ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR block's required size. ZipExrCompression.Decompress reconstructs the returned prefix while ExrDecoderCore processes the fu...