Detections
Analytics

SCA: security update for SixLabors.ImageSharp (GHSA-ffp7-56pq-64mr)

high Tenable Cloud Security Plugin ID 473809

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ICC LUT16 conversion accepts more than four
 output channels even though ClutCalculator.Calculate and LutEntryCalculator.CalculateLut store
 intermediate and output values in Vector4. When DecoderOptions.ColorProfileHandling is set to Convert, a
 malformed embedded profile can direct interpolation and output-LUT operations to write one float per
 declared channel beyond the four-float destination. This can corrupt memory and terminate the process; the
 default Preserve mode does not run ICC conversion. This issue is fixed in version 4.1.2. (CVE-2026-106112)

Solution

Update the SixLabors.ImageSharp library and its related packages to version 4.1.2 or later.

See Also

https://github.com/advisories/GHSA-ffp7-56pq-64mr

Plugin Details

Severity: High

ID: 473809

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/8/2026

Updated: 10/8/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.67

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-106112

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/7/2026

Vulnerability Publication Date: 10/6/2026

Reference Information

CVE: CVE-2026-106112

cwe: CWE-787