ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-106116

ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop

Published Oct 7, 2026 · catalog updated Oct 26, 2026 · ImageSharp: BigTIFF IFD count

Last checked Oct 29, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-106116. EPSS is 0.33%. Act only if a listed version of ImageSharp: BigTIFF IFD count is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (ImageSharp: BigTIFF IFD count).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium5.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.33%
Remediation
Advisory link
Affected products
NuGet SixLabors.ImageSharp

### Summary 4.1.1 can spend an attacker-controlled duration decoding a small malformed BigTIFF. The BigTIFF IFD entry-count field is 64-bit. The reader iterates once per declared entry, but when fewer than 20 bytes remain for an entry, the entry read returns without advancing. A 24-byte input can therefore run billions of iterations without consuming input. One decoder invocation occupied one executing thread for more than five seconds in the tested environment. This report makes no worker-pool exhaustion claim. ### Affected package and versions - Package: (NuGet) - Affected range: - Commit corresponds to release **v4.1.1**. BigTIFF decoding and the unbounded loop first appear in v2.0.0. Every release tag from v2.0.0 through v4.1.1 retains that loop without constraining the entry count or terminating when a truncated entry makes no progress. The 24-byte PoC exceeded the five-second timeout on published v2.0.0 and v4.1.1; the one-entry control returned promptly on both. ### Details [ ](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/Metadata/Profiles/Exif/ExifReader.cs#L220-L231) trusts the 64-bit IFD count and loops once per declared entry. When fewer than 20 bytes remain, [ ](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/Metadata/Profiles/Exif/ExifReader.cs#L439-L444) returns without advancing the stream or ending the outer loop. ### Tested environment The reproduction uses the DLL in the published NuGet 4.1.1 package: ### Reproduction The public call receives a 24-byte little-endian BigTIFF with its first IFD at offset 16 and entry count . There are no bytes for an entry. Run the supplied container under a five-second timeout. Complete observed output: exit code 124 means the decoder had not returned after five seconds. The control is identical except the entry count is : The control rejects malformed input promptly; it does not time out. No active exploitat

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • NuGet SixLabors.ImageSharp2.0.0 → 3.2.0
  • NuGet SixLabors.ImageSharp4.0.0 → 4.1.2

How to fix CVE-2026-106116

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-106116. EPSS is 0.33%. Act only if a listed version of ImageSharp: BigTIFF IFD count is installed.

Which versions are affected?

Compare what you have installed with SixLabors.ImageSharp 2.0.0 → 3.2.0; SixLabors.ImageSharp 4.0.0 → 4.1.2. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-835: Infinite Loop. EPSS 0.33%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 7, 2026 · GitHub Advisory Database

    Detected

    ### Summary 4.1.1 can spend an attacker-controlled duration decoding a small malformed BigTIFF. The BigTIFF IFD entry-count field is 64-bit. The reader iterates once per declared entry, but when fewer than 20 bytes remain for an entry, the entry read returns without advancing. A 24-byte input can therefore run billions of iterations without consuming input. One decoder invocation occupied one exec

  2. Oct 26, 2026 · GitHub Advisory Database

    Fix available

    SixLabors.ImageSharp fixed in 3.2.0; SixLabors.ImageSharp fixed in 4.1.2

  3. Oct 26, 2026 · GitHub Advisory Database

    Fix available

    SixLabors.ImageSharp fixed in 3.2.0

  4. Oct 26, 2026 · GitHub Advisory Database

    Fix available

    SixLabors.ImageSharp fixed in 4.1.2

  5. Oct 26, 2026 · GitHub Advisory Database

    Updated

    ### Summary 4.1.1 can spend an attacker-controlled duration decoding a small malformed BigTIFF. The BigTIFF IFD entry-count field is 64-bit. The reader iterates once per declared entry, but when fewer than 20 bytes remain for an entry, the entry read returns without advancing. A 24-byte input can therefore run billions of iterations without consuming input. One decoder invocation occupied one exec

Sources

References

Freshness

Last verified in this catalog Oct 26, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitHub Advisory DatabaseOct 29, 2026
  • OpenSSF OSV / OSV ScannerOct 29, 2026
  • CVE.orgOct 27, 2026