Customer HUB
Skip to content
English
Go to ironsoftware.com
  • There are no suggestions because the search field is empty.

Security Notice: SixLabors.ImageSharp Vulnerabilities

Last updated: 19 October 2026, 07:00 UTC

Summary

Patched versions of our products are now available on NuGet. They update SixLabors.ImageSharp to versions that fix  CVE-2026-106110 through CVE-2026-106118. Update each Iron Software product you use to the version below. Projects that target .NET Framework and other netstandard2.0 platforms remain on SixLabors.ImageSharp 2.1.13 and are not covered by this fix yet. See 'Are .NET Framework projects affected?' below.

Patched versions

Platform packages use the same version as their main package:

How to update

  • Update each Iron Software package to the patched version above, using the NuGet links.
  • If you suppressed the advisories while waiting, remove the suppression after updating so your scanner can confirm the fix.

Other products

If you use an Iron Software product that isn't listed above, contact us and we'll arrange a patched release for it.

Frequently asked questions

Will the supported .NET versions change?

No. Each product supports the same .NET versions as before.

Why is ImageSharp 3.2.0 still flagged by scanners?

ImageSharp 3.2.0 includes the fixes for the five advisories NuGet.org lists against it(CVE-2026-106110, CVE-2026-106113, CVE-2026-106114, CVE-2026-106115 and CVE-2026-106116) . The warnings are a record-keeping issue, not a code issue.

Security warnings come from public advisory records, which state the affected versions and the version that fixes each issue. These five records were last edited on October 7, 2026, and 3.2.0 was released on October 9, 2026. The records predate 3.2.0, so they still list every version up to 4.1.1 as affected. Tools such as NuGet.org, dotnet list package --vulnerable, and Dependabot read these records, so they flag 3.2.0 as well.

We know 3.2.0 contains the fixes because its release notes link to a Six Labors pull request that names all five advisories: ImageSharp PR #3208.

Six Labors has started correcting the records. On October 12, 2026, they updated two related advisories (CVE-2026-106117 /  CVE-2026-106118) to list 3.2.0 as fixed. Once the others are updated, the warnings should clear. Until then, if your scanner supports suppressions, you can suppress these five advisories for 3.2.0 and cite the pull request above as the reason.

Are .NET Framework projects affected?

1. Not affected by CVE-2026-106111, CVE-2026-106112, CVE-2026-106117 and CVE-2026-106118 

Six Labors’ own advisories list 3.0.0 or later as the first affected version for all four. 

  • CVE-2026-106111 and CVE-2026-106112 only affect ImageSharp 4.x.
  • CVE-2026-106118 is a bug in how ImageSharp reads tiled TIFF images. Version 2.1.13 cannot read tiled TIFFs at all, so the affected code does not exist there.
  • CVE-2026-106117 is a bug in how ImageSharp reads fax-compressed TIFFs. Version 2.1.13 does read these, but more safely. In 3.0.0, the code was changed to skip a bounds check that prevents writing past the end of a memory buffer, which is what makes a malformed file dangerous. Version 2.1.13 still has that check, so a malformed file causes an error instead of overwriting memory.

2.  Still affected by CVE-2026-106110, CVE-2026-106113, CVE-2026-106114, CVE-2026-106115 and CVE-2026-106116 

Projects targeting .NET Framework and other netstandard2.0 platforms remain on SixLabors.ImageSharp 2.1.13 and are not covered by the fix in our patched versions.

How each advisory affects our products

CVE Advisory Severity Problem Status in our products on .NET Framework
CVE-2026-106116 GHSA-wmxv-xphr-5c9g Moderate A malformed BigTIFF image makes the decoder loop forever, which hangs the application. Fix coming in the 2026.11 releases (beginning of November 2026). From those releases, every image our products decode is checked first and rejected if it's a malformed BigTIFF. In our testing, a 104-byte file that hangs ImageSharp 2.1.13 is rejected in under a second.
CVE-2026-106110 GHSA-j9gm-c75j-xc9q High The TIFF fax (CCITT T4) encoder writes past the end of its buffer. Not reachable. Our products never save TIFF through ImageSharp; TIFF output uses a different library (LibTiff).
CVE-2026-106115 GHSA-jjfr-hcj7-qf5w High The TIFF fax (CCITT T6) encoder writes past the end of its buffer. Not reachable. Same as CVE-2026-106110.
CVE-2026-106113 GHSA-j3p4-wp97-rph4 High HistogramEqualization uses an unchecked value as an array index. Not reachable. Our products never use HistogramEqualization.
CVE-2026-106114 GHSA-gwg2-r3hj-4w44 Moderate ICC colour profile parsing allocates memory from unchecked sizes. Not reachable. ImageSharp 2.x reads only the profile header when it loads an image. The vulnerable parser runs only when code reads IccProfile.Entries, which our products never do.

Suppressing scanner warnings

If your security policy allows it, you can suppress these five advisories. Suppress GHSA-wmxv-xphr-5c9g (CVE-2026-106116) only after updating to the 2026.11 releases; the other four can be suppressed now.

NuGet Audit (.NET SDK 8.0.400 or later, NuGet 6.11 or later): add this to your project file.

<ItemGroup>
   <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-wmxv-xphr-5c9g" />
   <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-j9gm-c75j-xc9q" />
   <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-jjfr-hcj7-qf5w" />
   <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-j3p4-wp97-rph4" />
   <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-gwg2-r3hj-4w44" />
 </ItemGroup>

Dependabot or Snyk: dismiss the alerts as "vulnerable code not used / not reachable" and link to this article as the reason.

If your own code uses ImageSharp on .NET Framework

The table above covers how our products use ImageSharp. If your application also calls ImageSharp directly and handles files from untrusted sources:

  • Don't call HistogramEqualization.
  • Don't save TIFF with TiffEncoder using Ccitt1D, CcittGroup3Fax or CcittGroup4Fax compression.
  • Don't read IccProfile.Entries.
  • Load images with IronSoftware.Drawing.ImageSharpLoader.Load(...) or AnyBitmap instead of Image.Load(...). Both include the BigTIFF check from the 2026.11 releases (beginning of November 2026).

Alternatively, move the project to .NET 8 or later, which uses the patched ImageSharp 4.1.3.

Advisory references

CVE GitHub advisory Severity Affects
CVE-2026-106110 GHSA-j9gm-c75j-xc9q High v2, v3, v4
CVE-2026-106111 GHSA-4q3p-rj5x-xv7p Moderate v4 only
CVE-2026-106112 GHSA-ffp7-56pq-64mr High v4 only
CVE-2026-106113 GHSA-j3p4-wp97-rph4 High v2, v3, v4
CVE-2026-106114 GHSA-gwg2-r3hj-4w44 Moderate v2, v3, v4
CVE-2026-106115 GHSA-jjfr-hcj7-qf5w High v2, v3, v4
CVE-2026-106116 GHSA-wmxv-xphr-5c9g Moderate v2, v3, v4
CVE-2026-106117 GHSA-jj3q-cwqj-842r High v3, v4
CVE-2026-106118 GHSA-v76p-62qx-wwq2 High v3, v4

ImageSharp support by platform

.NET 8/9/10: v4
.NET 6/7: v3
.NET Framework: v2

Forcing a .NET Framework project to v4 is not compatible, and you may see errors such as “SixLabors license required.”

ImageSharp versions in the patched releases of Iron products
.NET 8/9/10: 4.1.3 (patched)
.NET 6/7: 3.2.0 (patched)
.NET Framework: 2.1.13 (unchanged)

Getting help

Contact support@ironsoftware.com. Include your product, version and target framework, and the advisory IDs your scanner reports.

Copyright © 2026, Iron Software