CVE-2026-106112

{
  "etk_id": "ETK-2026-802",
  "cve_id": "CVE-2026-106112",
  "display_id": "CVE-2026-106112",
  "ghsa_id": "GHSA-ffp7-56pq-64mr",
  "euvd_id": "EUVD-2026-93553",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Out-of-bounds write in ImageSharp ICC conversion",
  "summary": "SixLabors.ImageSharp 4.0.0 through 4.1.1 can write beyond fixed-size storage while converting ICC profiles embedded in images. An attacker able to supply an image may cause the application to terminate if it processes that image with ICC conversion enabled.",
  "mitigation": "Upgrade SixLabors.ImageSharp to version 4.1.2 or later. Until then, keep ColorProfileHandling set to Preserve and do not enable Convert for untrusted images.",
  "vendor": "SixLabors",
  "product": "ImageSharp",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.0.0, <= 4.1.1"
      ],
      "ecosystem": "nuget",
      "fixed_versions": [
        "4.1.2"
      ],
      "package_name": "SixLabors.ImageSharp",
      "purl": "pkg:nuget/SixLabors.ImageSharp"
    }
  ],
  "cwes": [
    787
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": 0.0035,
  "epss_percentile": 0.2723,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 15.425734983333333,
  "t0_at": "2026-10-06T17:45:58.944000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-06T20:08:04.871738+00:00",
      "days": 0.09867971918981482,
      "is_lower_bound": false,
      "measured_at": "2026-10-06T17:45:58.944000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-06T17:45:58.944000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-06T17:45:58.944000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106112"
    }
  }
}