CVE-2024-32036

MEDIUM5.3EPSS 0.41%

SixLabors.ImageSharp vulnerable to data leakage

Published: 4/15/2024Modified: 1/9/2025

Description

### Impact A data leakage flaw was found in ImageSharp's JPEG and TGA decoders. This vulnerability is triggered when an attacker passes a specially crafted JPEG or TGA image file to a software using ImageSharp, potentially disclosing sensitive information from other parts of the software in the resulting image buffer. ### Patches The problem has been patched. All users are advised to upgrade to v3.1.4 or v2.1.8. ### Workarounds None ### References None

Affected packages (1)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1MEDIUM5.3CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

References (5)