What’s Vulnerable › Vulnerabilities

CVE-2024-41131: Out-of-bounds Write in SixLabors ImageSharp

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-22 · updated 2026-06-17
• Weakness: CWE-787

Description

ImageSharp is a 2D graphics API. An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service. All users are advised to upgrade to v3.1.5 or v2.1.9.

Affected products

• SixLabors ImageSharp: from 2.1.0 before 2.1.9; from 3.1.0 before 3.1.5 — fixed in 2.1.9, 3.1.5

How to fix

Upgrade to a fixed version: SixLabors ImageSharp 2.1.9, 3.1.5. Check the vendor advisory for mitigations.

References

• https://github.com/SixLabors/ImageSharp/commit/9dda64a8186af67baf06b6d9c1ab599c3608b693
• https://github.com/SixLabors/ImageSharp/commit/a1f287977139109a987065643b8172c748abdadb
• https://github.com/SixLabors/ImageSharp/pull/2754
• https://github.com/SixLabors/ImageSharp/pull/2756
• https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-63p8-c4ww-9cg7
• https://github.com/SixLabors/ImageSharp/commit/9dda64a8186af67baf06b6d9c1ab599c3608b693
• https://github.com/SixLabors/ImageSharp/commit/a1f287977139109a987065643b8172c748abdadb
• https://github.com/SixLabors/ImageSharp/pull/2754
• https://github.com/SixLabors/ImageSharp/pull/2756
• https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-63p8-c4ww-9cg7

Get alerted when CVE-2024-41131 or the next vulnerability affects your stack