Description

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process termination. Adaptive Histogram Equalization and AutoLevel are not affected by this report. This issue is fixed in version 4.1.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-10-06T18:16:52.953Z",
  "pubdate": "2026-10-06T18:16:52.953Z",
  "executiveSummary": "A critical out-of-bounds memory access vulnerability exists in ImageSharp versions 2.0.0 through 4.1.2. The vulnerability stems from improper validation of floating-point luminance data when processing specific TIFF image formats.\nThe flaw occurs during the HistogramEqualization operation when decoding 32-bit floating-point TIFFs as Image<HalfVector4>. By supplying a malformed or crafted TIFF file, an attacker can trigger non-finite or out-of-range luminance values within the ColorNumerics.GetBT709Luminance function.\nThis invalid data is subsequently passed to the GrayscaleLevelsRowOperation.Invoke method, which utilizes the value as an unchecked histogram offset. This lack of bounds checking results in unauthorized memory access, leading to process termination and a potential denial-of-service (DoS) condition.\nThe vulnerability is restricted to specific processing pipelines; Adaptive Histogram Equalization and AutoLevel operations remain unaffected. Successful exploitation requires the application to process attacker-supplied image data. Users are strongly advised to upgrade to version 4.1.2 or later to eliminate the risk of arbitrary memory access and application instability.",
  "technicalDetails": "The vulnerability resides within the color processing and histogram calculation pipeline of ImageSharp. Specifically, the issue manifests when the library decodes 32-bit floating-point TIFF images into the Image<HalfVector4> pixel format.\nDuring the HistogramEqualization process, the internal function ColorNumerics.GetBT709Luminance calculates luminance based on the pixel data. Due to a failure in input sanitization, the function does not account for non-finite (e.g., NaN, Infinity) or extreme floating-point values that may result from a malformed TIFF file.\nThe exploitation flow begins when an application accepts and attempts to process an attacker-supplied TIFF file containing crafted 32-bit floating-point values. When the library invokes HistogramEqualization, ColorNumerics.GetBT709Luminance generates an output value that represents the luminance of the pixel. If the input is engineered, this calculated luminance falls outside the expected range for a valid histogram index.\nThe vulnerability is triggered during the execution of GrayscaleLevelsRowOperation.Invoke. This component uses the result of the luminance calculation directly as an array index (offset) into a histogram structure without performing any boundary validation. Because the offset is unchecked, the code attempts to access memory outside the bounds of the allocated histogram array.\nThis out-of-bounds memory access leads to an immediate application crash, causing a denial-of-service. In certain memory layouts, this may also pose a risk of sensitive information disclosure depending on the data adjacent to the histogram buffer, although the primary documented impact is process termination.\nThe affected components include the color numerical conversion logic in ColorNumerics and the specific row operation logic in GrayscaleLevelsRowOperation. The vulnerability affects all versions from 2.0.0 up to 4.1.2. No authentication or elevated privileges are required for exploitation beyond the capability to trigger image processing on the target system."
}