CVE-2014-4481

CoreGraphics CCITT Memory Corruption - CVE-2014-4481 Apple CoreGraphics framework fails to validate the input when parsing CCITT group 3 encoded data resulting in a heap overflow condition. A small heap memory allocation can be overflowed with controlled data from the input resulting in arbitrary...

EUVD-2026-93557

ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the TIFF CCITT Group 4 T6 encoding process. An attacker can cause process termination and denial of service by supplying a specially crafted 1x1 Group 4 TIFF image that, when decoded and re-encoded, triggers...

EUVD-2026-93574

ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer...

GHSA-J9GM-C75J-XC9Q ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer

Summary ImageSharp's TIFF CCITT Group 3 T4 encoder can write beyond its allocated compressed-data buffer when encoding narrow 1-bit images. The unchecked writes can corrupt process memory and terminate the process. This report concerns only the T4 CcittGroup3Fax encoder path. It replaces the prio...

EUVD-2026-93560

ImageSharp: CCITT fax decompression T4/Modified Huffman: unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp...

ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp

Summary When decoding a fax-compressed strip TIFF Compression=3 / Group 3 1D, or Compression=2 / Modified Huffman, the CCITT decompressors write decoded runs through BitWriterUtils.WriteBits/WriteBit/WriteZeroBit, which advance and write bits via Unsafe.Add with read-modify-write semantics —...

GHSA-JJ3Q-CWQJ-842R ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp

Summary When decoding a fax-compressed strip TIFF Compression=3 / Group 3 1D, or Compression=2 / Modified Huffman, the CCITT decompressors write decoded runs through BitWriterUtils.WriteBits/WriteBit/WriteZeroBit, which advance and write bits via Unsafe.Add with read-modify-write semantics —...

CVE-2026-106115

ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode...

CVE-2026-106117

ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width. T4TiffCompression.WritePixelRun can accumulate oversized...

CVE-2026-106110

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and...

CVE-2026-106117 ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp

ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width. T4TiffCompression.WritePixelRun can accumulate oversized...

CVE-2026-106117 ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp

ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width. T4TiffCompression.WritePixelRun can accumulate oversized...

CVE-2026-106117

The SixLabors.ImageSharp 2D graphics library (versions 3.0.0 through 4.1.1 ) is vulnerable to a heap out-of-bounds (OOB) write during the decoding of strip TIFF images using CCITT Group 3 or Modified Huffman compression. The root cause is that T4TiffCompression.WritePixelRun can accumulate oversi...

CVE-2026-106117 ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp

ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width. T4TiffCompression.WritePixelRun can accumulate oversized...

CVE-2026-106115 ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer

ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode...

CVE-2026-106115

ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode...

CVE-2026-106115 ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer

ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode...

CVE-2026-106115 ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer

ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode...

CVE-2026-106115

The ImageSharp 2D graphics library (versions 2.1.0 through 4.1.2 ) is vulnerable to an out-of-bounds write in the TIFF CCITT Group 4 encoder . The root cause is that T6BitCompressor.CompressStrip can emit encoded row data and end-of-facsimile-block codes exceeding the buffer size allocated by Wid...