How many CVEs have a located fix in SixLabors/ImageSharp?

15 published CVEs have a fix traced to functions in SixLabors/ImageSharp, touching 113 functions across 59 files.

Which function in SixLabors/ImageSharp has been patched by the most CVEs?

Identify in src/ImageSharp/Formats/Gif/GifDecoderCore.cs has been changed by 8 CVE fixes, from 2024 to 2026.

How large is a typical CVE fix in SixLabors/ImageSharp?

The median fix changes 1,207 lines. 13% of fixes change 20 lines or fewer, and 7% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

csharp

#381 of 500 repositories

SixLabors/ImageSharp

Name: SixLabors/ImageSharp: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix October 6, 2026

15

CVE fixes located

Published CVEs

113

Functions patched

Distinct function sites

59

Files patched

Distinct source files

2024–2026

Years covered

By CVE publication date

Overview

15 published CVEs have a fix traced to functions in SixLabors/ImageSharp, the earliest published in 2024. Those fixes changed 113 distinct functions across 59 files, in 1,710 patch hunks.

Among the 500 repositories tracked here, SixLabors/ImageSharp ranks #381 by the number of CVEs with a located fix.

Most patched functions

Functions in SixLabors/ImageSharp changed by the most CVE fixes.

Most patched files

Files in SixLabors/ImageSharp changed by the most CVE fixes.

1src/ImageSharp/Formats/Gif/GifDecoderCore.cs9 CVEs · 9 functions
2src/ImageSharp/Formats/Png/PngDecoderCore.cs8 CVEs · 4 functions
3src/ImageSharp/Formats/Tga/TgaDecoderCore.cs8 CVEs · 0 functions
4src/ImageSharp/PixelFormats/PixelImplementations/PixelOperations/HalfVector4P.PixelOperations.cs7 CVEs · 7 functions
5src/ImageSharp/PixelFormats/PixelImplementations/PixelOperations/HalfVector4.PixelOperations.cs7 CVEs · 6 functions
6src/ImageSharp/Formats/Webp/WebpChunkParsingUtils.cs7 CVEs · 5 functions
7src/ImageSharp/PixelFormats/PixelImplementations/PixelOperations/RgbaHalfP.PixelOperations.cs7 CVEs · 5 functions
8src/ImageSharp/Formats/Jpeg/JpegDecoderCore.cs7 CVEs · 4 functions
9src/ImageSharp/Metadata/Profiles/ICC/DataReader/IccDataReader.Lut.cs7 CVEs · 4 functions
10src/ImageSharp/Common/Helpers/Numerics.cs7 CVEs · 3 functions

Fix size

How much code a CVE fix in SixLabors/ImageSharp changes, with backports counted once.

1,207

Median lines changed

Added plus removed, per CVE

13%

Fixes of 20 lines or fewer

Share of CVE fixes

7%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in SixLabors/ImageSharp, and the functions each fix changed.

ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write
CVE-2026-106118Create Decompress WritePixelRun
High · CVSS 7.5
EPSS 0.6%2026-10-06
ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp
CVE-2026-106117Decompress WritePixelRun Create
High · CVSS 7.5
EPSS 0.4%2026-10-06
ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop
CVE-2026-106116ToScaled Clamp Normalize
Medium · CVSS 5.3
EPSS 0.4%2026-10-06
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
CVE-2026-106115ToScaled Clamp Normalize
High · CVSS 7.5
EPSS 0.4%2026-10-06
ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions
CVE-2026-106114ToScaled Clamp Normalize
Medium · CVSS 5.3
EPSS 0.4%2026-10-06
ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index
CVE-2026-106113ToScaled Clamp Normalize
High · CVSS 7.5
EPSS 0.4%2026-10-06
ImageSharp: ICC LUT16 output channel count can write beyond Vector4
CVE-2026-106112ToScaled Clamp Normalize
High · CVSS 7.5
EPSS 0.4%2026-10-06
ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate
CVE-2026-106111ToScaled Clamp Normalize
Medium · CVSS 5.9
EPSS 0.4%2026-10-06
ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer
CVE-2026-106110ToScaled Clamp Normalize
High · CVSS 7.5
EPSS 0.4%2026-10-06
ImageSharp Triggers an Infinite Loop in its GIF Decoder When Skipping Malformed Comment Extension Blocks
CVE-2025-54575ReadComments
Medium · CVSS 5.3
EPSS 0.4%2025-07-30
Out-of-bounds Write in SixLabors ImageSharp
CVE-2025-27598SkipIndices DecodePixelRow LzwDecoder
High · CVSS 7.5
EPSS 0.6%2025-03-06
SixLabors ImageSharp has Excessive Memory Allocation in Gif Decoder
CVE-2024-41132LzwDecoder ReadApplicationExtension ReadFrameMetadata
Medium · CVSS 6.9
EPSS 0.8%2024-07-22

Get an alert for each new SixLabors/ImageSharp CVE, with the patched functions and AI-written analysis.

Monitor ImageSharp CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

0xJacky/nginx-ui15 CVEs apache/mynewt-nimble15 CVEs cubecart/v615 CVEs debian/busybox15 CVEs debian/libsoup315 CVEs debian/zziplib15 CVEs decolua/9router15 CVEs DSpace/DSpace15 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in SixLabors/ImageSharp.

How many CVEs have a located fix in SixLabors/ImageSharp?: 15 published CVEs have a fix traced to functions in SixLabors/ImageSharp, touching 113 functions across 59 files.
Which function in SixLabors/ImageSharp has been patched by the most CVEs?: Identify in src/ImageSharp/Formats/Gif/GifDecoderCore.cs has been changed by 8 CVE fixes, from 2024 to 2026.
How large is a typical CVE fix in SixLabors/ImageSharp?: The median fix changes 1,207 lines. 13% of fixes change 20 lines or fewer, and 7% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track SixLabors/ImageSharp CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing