ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without advancing the stream or terminating the outer loop, so a small malformed BigTIFF can keep one decoder thread executing for an attacker-controlled duration. This report does not claim worker-pool exhaustion. This issue is fixed in version 4.1.2.
Weakness
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Imagesharp | Sixlabors | 2.0.0 (including) | 3.2.0 (excluding) |
| Imagesharp | Sixlabors | 4.0.0 (including) | 4.1.2 (excluding) |
References
- https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec
- https://github.com/SixLabors/ImageSharp/pull/3187
- https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2
- https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g
- https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g