Sensitive Information in Resource Not Removed Before Reuse

Overview Affected versions of this package are vulnerable to Sensitive Information in Resource Not Removed Before Reuse in the ExrDecoderCore process when handling ZIP-compressed OpenEXR images. An attacker can access sensitive memory contents from prior operations by submitting a crafted image...

GHSA-4Q3P-RJ5X-XV7P ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate

Summary A crafted ZIP-compressed OpenEXR image can return stale memory from a prior ImageSharp operation as decoded pixels. The ZIP decoder accepts a non-empty inflate result shorter than the EXR block's required size, then the EXR decoder reads the full expected block. This is a process-local,...