Skip to content

Update dependency SixLabors.ImageSharp to v2 [SECURITY] - autoclosed - #23

Closed
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/nuget-sixlabors.imagesharp-vulnerability
Closed

renovate[bot] wants to merge 1 commit into
masterfrom
renovate/nuget-sixlabors.imagesharp-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Sep 13, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
SixLabors.ImageSharp 1.0.4 → 2.1.11 age confidence

Use After Free in SixLabors.ImageSharp

CVE-2024-27929 / GHSA-65x7-c272-7g7r

More information

Details

Impact

A heap-use-after-free flaw was found in ImageSharp's InitializeImage() function of PngDecoderCore.cs file. This vulnerability is triggered when an attacker passes a specially crafted PNG image file to ImageSharp for conversion, potentially leading to information disclosure.

Patches

The problem has been patched. All users are advised to upgrade to v3.1.3 or v2.1.7.

Workarounds

None

References

None

Severity

  • CVSS Score: 7.1 / 10 (High)
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).


SixLabors.ImageSharp vulnerable to Memory Allocation with Excessive Size Value

CVE-2024-32035 / GHSA-g85r-6x2q-45w7

More information

Details

Impact

A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in image decoders. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw.

This flaw can be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on ImageSharp for image processing tasks. Users and administrators are advised to update to the latest version of ImageSharp that addresses this vulnerability to mitigate the risk of exploitation.

Patches

The problem has been patched. All users are advised to upgrade to v3.1.4 or v2.1.8.

Workarounds

Before calling Image.Decode(Async), use Image.Identify to determine the image dimensions in order to enforce a limit.

References

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).


SixLabors.ImageSharp vulnerable to data leakage

CVE-2024-32036 / GHSA-5x7m-6737-26cr

More information

Details

Impact

A data leakage flaw was found in ImageSharp's JPEG and TGA decoders. This vulnerability is triggered when an attacker passes a specially crafted JPEG or TGA image file to a software using ImageSharp, potentially disclosing sensitive information from other parts of the software in the resulting image buffer.

Patches

The problem has been patched. All users are advised to upgrade to v3.1.4 or v2.1.8.

Workarounds

None

References

None

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).


SixLabors ImageSharp Out-of-bounds Write

CVE-2024-41131 / GHSA-63p8-c4ww-9cg7

More information

Details

Impact

An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service.

Patches

The problem has been patched. All users are advised to upgrade to v3.1.5 or v2.1.9.

Workarounds

None.

References

https://github.com/SixLabors/ImageSharp/pull/2754
https://github.com/SixLabors/ImageSharp/pull/2756

Severity

  • CVSS Score: 8.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).


SixLabors ImageSharp has Excessive Memory Allocation in Gif Decoder

CVE-2024-41132 / GHSA-qxrv-gp6x-rc23

More information

Details

Impact

What kind of vulnerability is it? Who is impacted?

A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in the Gif decoder. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw.

Patches

Has the problem been patched? What versions should users upgrade to?

The problem has been patched. All users are advised to upgrade to v3.1.5 or v2.1.9.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Before calling Image.Decode(Async), use Image.Identify to determine the image dimensions in order to enforce a limit.

References

Are there any links users can visit to find out more?

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).


Out-of-bounds Write in SixLabors ImageSharp

CVE-2025-27598 / GHSA-2cmq-823j-5qj8

More information

Details

Impact

An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service.

Patches

The problem has been patched. All users are advised to upgrade to v3.1.7 or v2.1.10.

Workarounds

None.

References

https://github.com/SixLabors/ImageSharp/issues/2859
https://github.com/SixLabors/ImageSharp/issues/2890

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).


SixLabors ImageSharp Has Infinite Loop in GIF Decoder When Skipping Malformed Comment Extension Blocks

CVE-2025-54575 / GHSA-rxmq-m78w-7wmc

More information

Details

Impact

A specially crafted GIF file containing a malformed comment extension block (with a missing block terminator) can cause the ImageSharp GIF decoder to enter an infinite loop while attempting to skip the block. This leads to a denial of service. Applications processing untrusted GIF input should upgrade to a patched version.

Patches

The problem has been patched. All users are advised to upgrade to v3.1.11 or v2.1.11.

Workarounds

None.

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).


Release Notes

SixLabors/ImageSharp (SixLabors.ImageSharp)

v2.1.11

What's Changed

Full Changelog: SixLabors/ImageSharp@v2.1.10...v2.1.11

v2.1.10

What's Changed

Full Changelog: SixLabors/ImageSharp@v2.1.9...v2.1.10

v2.1.9

What's Changed

Full Changelog: SixLabors/ImageSharp@v2.1.8...v2.1.9

v2.1.8

What's Changed

Full Changelog: SixLabors/ImageSharp@v2.1.7...v2.1.8

v2.1.7

What's Changed

Full Changelog: SixLabors/ImageSharp@v2.1.6...v2.1.7

v2.1.6

What's Changed

Full Changelog: SixLabors/ImageSharp@v2.1.5...v2.1.6

v2.1.5

What's Changed

Full Changelog: SixLabors/ImageSharp@v2.1.4...v2.1.5

v2.1.4

What's Changed

Full Changelog: SixLabors/ImageSharp@v2.1.3...v2.1.4

v2.1.3

What's Changed

Full Changelog: SixLabors/ImageSharp@v2.1.2...v2.1.3

v2.1.2

What's Changed

Full Changelog: SixLabors/ImageSharp@v2.1.1...v2.1.2

v2.1.1

What's Changed

Full Changelog: SixLabors/ImageSharp@v2.1.0...v2.1.1

v2.1.0

Advisories and Breaking Changes

Release Notes

Area:Performance

Bug

Codequality

Documentation

  • Fix documentation of HorizontalResolution and VerticalResolution properties - #​1981 via @​0xced

Enhancement

Formats:Jpeg

Formats:Png

Formats:Tiff

Metadata:Exif

Other

Unit Tests

New Contributors

Full Changelog: SixLabors/ImageSharp@v2.0.0...v2.1.0

v2.0.0

Advisories and Breaking Changes

Major breaking changes
  • Due to the new unmanaged memory engine, we had to redesign our pixel processing and low level memory management API-s. The most visible change is that the GetPixelRowSpan() methods have been replaced with ProcessPixelRows() variants. This was done to guarantee memory safety. For more details see:
  • Png and Jpeg now decode to pixels formats closer to the encoded format when using the non-generic API. (For example Jpeg now decodes to Image<Rgb24> instead of Image<Rgba32>.) This was done to reduce memory usage and remove some surprises for users.
  • We've dropped the old NetStandard 1.3 target. This targeted frameworks not supported by Microsoft and was adding overhead to development.
Complete list of breaking PR-s

Release Notes

API

Area:Build

Area:Formats

Area:Performance

Bug

Codequality

Enhancement

Formats:Jpeg

Formats:Png

Formats:Webp

Other

Unit Tests

New Contributors

Full Changelog: SixLabors/ImageSharp@v1.0.4...v2.0.0


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/nuget-sixlabors.imagesharp-vulnerability branch 2 times, most recently from 17d28c9 to f07cd85 Compare September 17, 2026 13:39
@renovate
renovate Bot force-pushed the renovate/nuget-sixlabors.imagesharp-vulnerability branch from f07cd85 to 6d549fd Compare October 1, 2026 05:28
@renovate renovate Bot changed the title Update dependency SixLabors.ImageSharp to v2 [SECURITY] Update dependency SixLabors.ImageSharp to v2 [SECURITY] - autoclosed Oct 11, 2026
@renovate renovate Bot closed this Oct 11, 2026
@renovate
renovate Bot deleted the renovate/nuget-sixlabors.imagesharp-vulnerability branch October 11, 2026 16:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants