Memory Allocation with Excessive Size Value in SixLabors.ImageSharp

Overview

A denial-of-service vulnerability exists in the SixLabors.ImageSharp library. The bug is triggered when the library processes specially crafted image files, leading to excessive memory allocation that can exhaust available process memory. The root cause is the absence of sufficient bounds checking and memory limits on the internal memory allocator, allowing a malicious image to trigger unbounded allocations.

Exploitation

An attacker can exploit this vulnerability by providing a crafted image file to any application or service that uses ImageSharp for image decoding. No authentication is required; the attack can be over the network if the application processes user-uploaded images. The flaw is present in the memory allocation layer as shown in the commit that introduces memory group and single-buffer allocation limits [4]. Older versions do not enforce these limits.

Impact

Successful exploitation results in a denial of service. The affected application or service may become unresponsive or crash due to memory exhaustion. This can disrupt availability for legitimate users.

Mitigation

Users must update to ImageSharp version 3.1.4 or 2.1.8, which contain the fix [3][4]. The patch introduces configurable memory allocation limits (e.g., MemoryGroupAllocationLimitBytes and SingleBufferAllocationLimitBytes) that prevent unbounded allocations [4]. Administrators should also consider using DecoderOptions to limit decode size and frame count, and prefer Image.Identify() for preflight checks as recommended in the security documentation [2].