CVE-2024-32036CWE-226

SixLabors.ImageSharp vulnerable to data leakage

Medium · published April 15, 2024

CVSS v3.1
5.3
EPSS
1%
Percentile
46.7
In the wild
Unconfirmed
What it is

ImageSharp is a 2D graphics API. A data leakage flaw was found in ImageSharp's JPEG and TGA decoders. This vulnerability is triggered when an attacker passes a specially crafted JPEG or TGA image file to a software using ImageSharp, potentially disclosing sensitive information from other parts of the software in the resulting image buffer. The problem has been patched in v3.1.4 and v2.1.8.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00575 · 46.7th percentile
Weakness
CWE-226 · Sensitive Information in Resource Not Removed Before Reuse
Published
2024-04-15T20:08Z
EPSS history
Timeline
  • 15 APR 20:08Z
    SixLabors.ImageSharp vulnerable to data leakage
    cvelistv5