{"id":"CVE-2024-41131","published":"2024-07-22T14:24:42Z","modified":"2024-08-02T04:46:52Z","title":"Out-of-bounds Write in SixLabors ImageSharp","vendor":"SixLabors","product":"ImageSharp","tier":"tail","description":{"text":"ImageSharp is a 2D graphics API. An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service. All users are advised to upgrade to v3.1.5 or v2.1.9.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00669,"percentile":0.51933,"provenance":"source"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-63p8-c4ww-9cg7","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/SixLabors/ImageSharp/pull/2754","tags":["x_refsource_MISC"]},{"url":"https://github.com/SixLabors/ImageSharp/pull/2756","tags":["x_refsource_MISC"]},{"url":"https://github.com/SixLabors/ImageSharp/commit/9dda64a8186af67baf06b6d9c1ab599c3608b693","tags":["x_refsource_MISC"]},{"url":"https://github.com/SixLabors/ImageSharp/commit/a1f287977139109a987065643b8172c748abdadb","tags":["x_refsource_MISC"]}],"priority":{"score":15.6,"factors":[{"name":"EPSS percentile","points":10.39},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"sixlabors","affectedVersions":[{"vendor":"SixLabors","product":"ImageSharp","versions":["< 2.1.9",">= 3.0.0, < 3.1.5"]}],"affected":[{"ecosystem":"NuGet","package":"SixLabors.ImageSharp","vulnerableRanges":["<2.1.9",">=3.0.0, <3.1.5"],"patched":["2.1.9","3.1.5"],"from":["GHSA-63p8-c4ww-9cg7"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2274","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-sixlabors-imagesharp-cve-2024-32035","children":[{"from":"CVE-2024-41131","to":"CVE-2024-41132","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/ImageSharp/Formats/Gif/LzwDecoder.cs"],"commits":["https://github.com/SixLabors/ImageSharp/commit/9dda64a8186af67baf06b6d9c1ab599c3608b693","https://github.com/SixLabors/ImageSharp/commit/a1f287977139109a987065643b8172c748abdadb","https://github.com/SixLabors/ImageSharp/commit/59de13c8cc47f2b402e2c43aa7024511d029d515","https://github.com/SixLabors/ImageSharp/commit/9816ca45016c5d3859986f3c600e8934bc450a56"],"basis":"shared function","functions":["LzwDecoder"]}]}],"packageHistory":[{"cve":"CVE-2024-27929","published":"2024-03-05","fixed":"3.1.3","kev":false},{"cve":"CVE-2024-32035","published":"2024-04-15","fixed":"3.1.4","kev":false,"link":{"from":"CVE-2024-32035","to":"CVE-2024-41131","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:SixLabors.ImageSharp","fromFixed":"3.1.4","toFixed":"3.1.5","daysApart":98},{"kind":"version-step","provenance":"source","package":"NuGet:SixLabors.ImageSharp","fromFixed":"2.1.8","toFixed":"2.1.9","daysApart":98}]}},{"cve":"CVE-2024-32036","published":"2024-04-15","fixed":"3.1.4","kev":false},{"cve":"CVE-2024-41131","published":"2024-07-22","fixed":"3.1.5","kev":false},{"cve":"CVE-2024-41132","published":"2024-07-22","fixed":"3.1.5","kev":false},{"cve":"CVE-2025-27598","published":"2025-03-06","fixed":"3.1.7","kev":false},{"cve":"CVE-2025-54575","published":"2025-07-30","fixed":"3.1.11","kev":false}],"package":"NuGet:SixLabors.ImageSharp"}}