ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process termination. Adaptive Histogram Equalization and AutoLevel are not affected by this report. This issue is fixed in version 4.1.2.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit
    floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or
    out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the
    resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process
    termination. Adaptive Histogram Equalization and AutoLevel are not affected by this report. This issue is
    fixed in version 4.1.2. (CVE-2026-106113)

ID	Name	Product	Family	Type	Severity
474137	Echo: SixLabors.ImageSharp, sixlabors.imagesharp: security update to 4.1.2	Tenable Cloud Security	Echo Local Security Checks	Local	high
474137	Echo: SixLabors.ImageSharp, sixlabors.imagesharp: security update to 4.1.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
473810	SCA: security update for SixLabors.ImageSharp (GHSA-j3p4-wp97-rph4)	Tenable Cloud Security	SCA Checks	Local	high
473810	SCA: security update for SixLabors.ImageSharp (GHSA-j3p4-wp97-rph4)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-106113

high

Tenable Plugins

high

high

high

high