CVE-2026-106111

The record

ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR block's required size. ZipExrCompression.Decompress reconstructs the returned prefix while ExrDecoderCore processes the full expected block from a buffer obtained through Configuration.Default, allowing bytes retained from a completed prior ImageSharp operation to appear in decoded pixels. Applications that expose pixels or output from the later attacker-controlled EXR decode can disclose process-local image data. This issue is fixed in version 4.1.2.

Affected packages

Related vulnerabilities

• CVE-2026-114501 Pillow is a Python imaging library. CWE-226
• CVE-2026-107315 pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is… CWE-226
• CVE-2026-74791 Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when… CWE-226
• CVE-2026-74250 In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run… CWE-226
• CVE-2026-47247 libheif is a HEIF and AVIF file format decoder and encoder. CWE-226
• CVE-2026-48984 pam_usb provides hardware authentication for Linux using ordinary removable media. CWE-226
• CVE-2026-32960 SD-330AC and AMC Manager provided by silex technology, Inc. CWE-226
• CVE-2026-5795 In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which… CWE-226