CERT24GHSA-v76p-62qx-wwq2 — ImageSharp: for tiled fax TIFFs, the tile buffer is sized by TileWidth but the fax decompressor writes ImageWidth-sized scanlines — heap out-of-bounds writeLoading data…
CERT24Threat Observatory
Period

GHSA-v76p-62qx-wwq2 — ImageSharp: for tiled fax TIFFs, the tile buffer is sized by TileWidth but the fax decompressor writes ImageWidth-sized scanlines — heap out-of-bounds write

ImageSharp has a vulnerability when decoding tiled TIFF files with fax compression. The tile buffer is allocated based on TileWidth, while the T4/T6/MH decompressor treats the full image width as the scanline length and writes beyond the buffer. This can cause a deterministic process crash and represents a heap out-of-bounds write with potential code-execution impact.

← Back to intelligence

GHSA-v76p-62qx-wwq2 — ImageSharp: for tiled fax TIFFs, the tile buffer is sized by TileWidth but the fax decompressor writes ImageWidth-sized scanlines — heap out-of-bounds write

ImageSharp has a vulnerability when decoding tiled TIFF files with fax compression. The tile buffer is allocated based on TileWidth, while the T4/T6/MH decompressor treats the full image width as the scanline length and writes beyond the buffer. This can cause a deterministic process crash and represents a heap out-of-bounds write with potential code-execution impact.