high7.1
CVE-2024-27929
Use After Free in SixLabors.ImageSharp
Impact
### Impact A heap-use-after-free flaw was found in ImageSharp's InitializeImage() function of PngDecoderCore.cs file. This vulnerability is triggered when an attacker passes a specially crafted PNG image file to ImageSharp for conversion, potentially leading to information disclosure. ### Patches The problem has been patched. All users are advised to upgrade to v3.1.3 or v2.1.7. ### Workarounds None ### References None
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | SixLabors.ImageSharp | >= 3.0.0, < 3.1.3 | 3.1.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sixlabors | Imagesharp | before 2.1.7 from 3.1.0 before 3.1.3 |