CVE-2025-27598: Out-of-bounds Write in SixLabors ImageSharp

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-03-06 · updated 2026-06-17
Weakness: CWE-787

Description

ImageSharp is a 2D graphics API. An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service. The problem has been patched. All users are advised to upgrade to v3.1.7 or v2.1.10.

Affected products

SixLabors ImageSharp: before 2.1.10; from 3.0.0 before 3.1.7 — fixed in 2.1.10, 3.1.7

How to fix

Upgrade to a fixed version: SixLabors ImageSharp 2.1.10, 3.1.7. Check the vendor advisory for mitigations.

References

https://github.com/SixLabors/ImageSharp/issues/2859
https://github.com/SixLabors/ImageSharp/pull/2890
https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-2cmq-823j-5qj8
https://github.com/SixLabors/ImageSharp/issues/2859

Get alerted when CVE-2025-27598 or the next vulnerability affects your stack