# ImageSharp: ICC LUT16 output channel count can write beyond Vector4

Malformed ICC LUT16 profile with 15 output channels overflows a Vector4 buffer during ImageSharp color conversion, crashing the process via memory corruption.

- Payout: Research
- Severity: high
- Program: ImageSharp
- Found by: MegaManSec
- Disclosed: 2026-10-07
- CVE: CVE-2026-106112
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-ffp7-56pq-64mr
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-ffp7-56pq-64mr
- Tags: area:os domain:desktop domain:oss impact:dos kind:research platform:ghsa sev:high tech:dotnet technique:source-review vuln:dos vuln:memory-corruption

**Target:** ICC color profile parser / LUT16 CLUT conversion in ImageSharp decoder
**Root cause:** IccClut accepts up to 15 output channels, but ClutCalculator.Calculate and LutEntryCalculator.CalculateLut write one float per declared output channel into a four-float Vector4 buffer, overflowing it.
**Steps:**
1. Craft an ICC profile with an A2B0 `mft2` LUT16 tag declaring 3 input and 15 output channels (`stream.WriteByte(inCh); stream.WriteByte((byte)outCh);`).
2. Embed the profile in a PNG via `source.Metadata.IccProfile = new IccProfile(icc)` and save.
3. Decode with `new DecoderOptions { ColorProfileHandling = ColorProfileHandling.Convert }` and `Image.Load(options, png)`.
4. Observe process termination (exit 139) vs. control with 3 output channels completing.
**How found:** Noted the mismatch between the ICC parser's accepted channel range (1-15) and the fixed four-float Vector4 used as the interpolation result buffer, then built a minimal valid LUT16 profile to exercise the path.
**Exploitation:** Attacker supplies an image with a crafted embedded ICC profile; any application decoding it with ColorProfileHandling=Convert triggers out-of-bounds writes in the LUT16 CLUT and output-LUT paths, corrupting stack memory and terminating the process.
**Insight:** When a parser accepts a variable channel/component count but downstream math uses fixed-width SIMD types (Vector4), check every write site that indexes by declared count — the parser's upper bound is the overflow size.