ImageSharp: ICC LUT16 output channel count can write beyond Vector4

{
  "id": "78fb7c8ec6ff1ce60bfe28506c59653dae244d701085619c99d08184caf42d23",
  "url": "https://osv.dev/vulnerability/GHSA-ffp7-56pq-64mr",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "ImageSharp: ICC LUT16 output channel count can write beyond Vector4",
    "summary": "### Summary When ICC conversion is enabled, a malformed embedded ICC LUT16 profile with more than four output channels can corrupt memory during ImageSharp color conversion. The ICC parser accepts up to 15 CLUT output channels, while the conversion implementation stores intermediate values in `Vector4`. ### Affected package and versions - Package: `SixLabors.ImageSharp` (NuGet) - Affected published releases: **4.0.0, 4.1.0, and 4.1.1** - Affected range: `>= 4.0.0, <= 4.1.1` - Commit `0815358f9202a78bc7f3b83e19282dc3654b500f` corresponds to release **v4.1.1**. The reproduced `ColorProfileHandling.Convert` path and the unsafe `Vector4` LUT operations are present in v4.0.0 and unchanged through v4.1.1. The three-output control succeeds on all three published 4.x releases; the fifteen-output exploit terminates all three. ### Details `IccClut` accepts one through fifteen input and output channels. In the reproduced `A2B0` LUT16 path, an attacker-controlled profile declares three input channels and fifteen output channels. [`ClutCalculator.Calculate`](https://github.com/SixLabors/ImageSharp/blob/0815358f9202a78bc7f3b83e19282dc3654b500f/src/ImageSharp/ColorProfiles/Icc/Calculators/ClutCalculator.cs#L66-L87) passes a pointer to a four-float `Vector4` result into interpolation code that writes one float per declared output channel. It consequently writes fifteen floats. The same LUT16 tag also has fifteen output LUTs; their [`LutEntryCalculator.CalculateLut`](https://github.com/SixLab",
    "evidence": "osv:GHSA-ffp7-56pq-64mr",
    "products": [
      {
        "name": {
          "value": "SixLabors.ImageSharp",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "4.1.2",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": [
          {
            "value": "4.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "4.1.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "4.1.1",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "high",
    "structured": {
      "id": "GHSA-ffp7-56pq-64mr",
      "aliases": [
        "CVE-2026-106112",
        "GHSA-ffp7-56pq-64mr"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.0.0"
                },
                {
                  "fixed": "4.1.2"
                }
              ]
            }
          ],
          "package": {
            "name": "SixLabors.ImageSharp",
            "purl": "pkg:nuget/SixLabors.ImageSharp",
            "ecosystem": "NuGet"
          },
          "versions": [
            "4.0.0",
            "4.1.0",
            "4.1.1"
          ],
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-ffp7-56pq-64mr/GHSA-ffp7-56pq-64mr.json",
            "last_known_affected_version_range": "<= 4.1.1"
          }
        }
      ],
      "modified": "2026-10-07T20:30:06.058592993Z",
      "provider": "osv",
      "references": [
        "https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-ffp7-56pq-64mr",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-106112",
        "https://github.com/SixLabors/ImageSharp/pull/3187",
        "https://github.com/SixLabors/ImageSharp/commit/b03f0ed7e5be760eecc740fa53dd166b18ae9b23",
        "https://github.com/SixLabors/ImageSharp",
        "https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-787"
        ],
        "severity": "HIGH",
        "github_reviewed": true,
        "nvd_published_at": "2026-10-06T18:16:52Z",
        "github_reviewed_at": "2026-10-07T20:24:37Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-106112",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 97235,
  "published_at": "2026-10-07T20:24:37+00:00"
}