Vulnerability details

CVE-2026-106113

SixLabors ImageSharp

ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index

CVSS 3.1

7.5High

Official description

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process termination. Adaptive Histogram Equalization and AutoLevel are not affected by this report. This issue is fixed in version 4.1.2.

CVSS scores

Score	Version	Source	Vector
7.5High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Affected products

Vendor	Product	Versions	Source
SixLabors	ImageSharp	>= 2.0.0, < 4.1.2	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4 x_refsource_CONFIRM
https://github.com/SixLabors/ImageSharp/pull/3187 x_refsource_MISC
https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d x_refsource_MISC
https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-06
Last updated: 2026-10-07
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.39%

Probability of exploitation in 30 days

33.3%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-787
Out-of-bounds Write