ImageSharp 2D Graphics Library Vulnerability in ExrBaseDecompressor

CVE-2026-106111

What is CVE-2026-106111?

The ImageSharp 2D graphics library has a vulnerability in the ExrBaseDecompressor where an attacker could exploit the ZIP inflation process. This occurs when the UndoZipCompression method accepts an incorrect output length for non-empty ZIP results, potentially leading to the exposure of sensitive process-local image data. An application decoding images with attacker-controlled EXR files may inadvertently reveal internal pixel data from previous operations. Versions prior to 4.1.2 address this issue, ensuring safer handling of image decompression.

References