The flaw lies in the EXR ZIP decoder of ImageSharp. When the UndoZipCompression routine processes a ZIP or ZIPS inflate result that is smaller than the EXR block requires, it assembles only a prefix while the decoder still reads the full expected block from a buffer supplied through Configuration.Default. This mismatch allows bytes retained from a previous ImageSharp operation to appear in the decoded pixels, exposing stale allocator data and creating a channel for information disclosure.

SixLabors ImageSharp versions 4.0.0 through 4.1.2 inclusive are affected. Version 4.1.2 and later contain a patch that eliminates the bug. Earlier releases are not listed as fixed, so they are presumed vulnerable until the security fix is applied.

The CVSS score of 5.9 indicates medium severity. EPSS data is not available and the flaw is not listed in CISA KEV, suggesting limited known exploitation. An attacker who can deliver a crafted EXR file to an application that uses ImageSharp can trigger the bug, causing the application to leak process‑local image data. The risk is confined to environments where ImageSharp processes external or untrusted EXR images.