The flaw in ImageSharp’s TIFF CCITT Group 3 encoder originates from an undersized buffer for narrow 1‑bit images. When encoding these images, the encoder writes beyond the allocated memory, corrupting the process’s memory space and causing a crash. The memory overwrite could, in theory, be manipulated to execute arbitrary code, but the confirmed impact is process termination and potential denial of service.

ImageSharp releases from 2.0.0 through 4.1.1 are affected. The vulnerability is fixed in version 4.1.2, which should be used for all .NET applications that render or regenerate TIFF images.

The CVSS score of 7.5 rates this flaw as High severity. While the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, attacker‑controlled encode or decode‑and‑re‑encode flows can trigger the overflow. The risk is elevated for services that expose the encoder to untrusted data or run with elevated privileges; it could lead to a denial of service or, in worst cases, arbitrary code execution.