CVE-2026-106118 ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write

ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constructs T4, T6, and Modified Huffman decompressors using the full frame width. TiffDecoderCore.DecodeTilesChunky can therefore...

CVE-2026-106118 ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write

ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constructs T4, T6, and Modified Huffman decompressors using the full frame width. TiffDecoderCore.DecodeTilesChunky can therefore...

CVE-2026-106118

The ImageSharp 2D graphics library (versions 3.0.0 through 4.1.1 ) is vulnerable to a heap out-of-bounds write during tiled TIFF decoding. The root cause is a mismatch where the destination buffer is allocated using TileWidth , but the T4, T6, and Modified Huffman decompressors are constructed us...

CVE-2026-106113

The ImageSharp 2D graphics library (versions 2.0.0 through 4.1.2 ) is vulnerable to an out-of-bounds access during the decoding of an attacker-supplied 32-bit floating-point TIFF as Image . When HistogramEqualization is applied, ColorNumerics.GetBT709Luminance can produce non-finite or out-of-ran...

CVE-2026-106113 ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the...

CVE-2026-106113

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the...

CVE-2026-106113 ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the...

CVE-2026-106113 ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the...

CVE-2026-106110 ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and...

CVE-2026-106110 ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and...

PT-2026-106830

Name of the Vulnerable Software and Affected Versions ImageSharp versions 2.0.0 through 4.1.1 Description Decoding a 32-bit floating-point TIFF as Image and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. The...

CVE-2026-106118: Out-of-bounds Write

ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constructs T4, T6, and Modified Huffman decompressors using the full frame width. TiffDecoderCore.DecodeTilesChunky can therefore...

CVE-2026-106113: Out-of-bounds Write

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the...

PT-2026-106839

Name of the Vulnerable Software and Affected Versions ImageSharp versions 3.0.0 through 4.1.0 Description In the tiled TIFF decoding process, a destination buffer is allocated using TileWidth, but the TiffDecompressorsFactory.Create function constructs T4, T6, and Modified Huffman decompressors...

CVE-2026-106110: Out-of-bounds Write

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index through malformed LLB op validation in the solver’s SourceOp and DiffOp handling. An attacker can crash buildkitd by submitting a crafted LLB definition with an input/dependency count mismatch. The...

NPM: vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process

NPM: vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process vulnerability discovered by ? in WordPress Npm vm2 versions = 3.12.1...

GHSA-2V2P-6J97-CJG9 vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process

Summary An untrusted script run by VM.run can construct an embedder-exposed host function that returns a rejected native Promise and ignore the result. The sandbox-to-host construct trap forwards that Promise without applying the host-side rejection handling already used by the neighboring apply...

vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process

Summary An untrusted script run by VM.run can construct an embedder-exposed host function that returns a rejected native Promise and ignore the result. The sandbox-to-host construct trap forwards that Promise without applying the host-side rejection handling already used by the neighboring apply...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: riscv/mm: Added handling for VMFAULTSIGSEGV in mmfaulterror. Handle VMFAULTSIGSEGV in the page fault path so that we can correctly kill the process without causing bugs in the kernel...