# ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer

ImageSharp's TIFF CCITT T6 encoder allocates Width*rowsPerStrip bytes but writes EOFB codes unchecked, so a 1x1 Group 4 TIFF crashes the process on re-encode.

- Payout: Research
- Severity: high
- Program: ImageSharp
- Found by: MegaManSec
- Disclosed: 2026-10-07
- CVE: CVE-2026-106115
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-jjfr-hcj7-qf5w
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-jjfr-hcj7-qf5w
- Tags: area:os domain:desktop domain:oss impact:dos kind:research platform:ghsa sev:high tech:dotnet technique:source-review vuln:dos vuln:memory-corruption

**Target:** TIFF CCITT Group 4 (T6) compressor in SixLabors.ImageSharp
**Root cause:** TiffCcittCompressor.Initialize allocates only Width*rowsPerStrip bytes for the compressed strip buffer, and T6BitCompressor.CompressStrip appends two 12-bit EOFB codes via WriteCode without any capacity check, overflowing the undersized span.
**Steps:**
1. Reference SixLabors.ImageSharp 4.1.1 in a net8.0 project.
2. Load the base64 1x1 Group 4 TIFF (`SUkqAAgAAAAJAAABAwABAAAAAQAAAAEBAwABAAAAAQAAAAIBAwABAAAAAQAAAAMBAwABAAAABAAAAAYBAwABAAAAAAAAABEBBAABAAAAegAAABUBAwABAAAAAQAAABYBBAABAAAAAQAAABcBBAABAAAABAAAAAAAAACACACA`) with `Image.Load`.
3. Confirm decoded metadata shows `compression=CcittGroup4Fax bits=Bit1`.
4. Re-encode with default `image.Save(output, new TiffEncoder())` so the encoder inherits CcittGroup4Fax and 1-bit settings.
5. Observe unhandled `ArgumentOutOfRangeException` in `TiffCcittCompressor.CompressStrip` and exit code 134; the `Compression = TiffCompression.None` control succeeds.
**How found:** Reporter traced the T6 compressor's buffer allocation (Width*rowsPerStrip) against the EOFB codes appended after each strip, noting the 1x1 case yields a one-byte buffer while WriteCode writes unchecked, then confirmed via decode-and-re-encode of a minimal Group 4 TIFF.
**Exploitation:** Attacker supplies a valid 1x1 Group 4 TIFF; any application that decodes it and re-encodes with default TiffEncoder (inheriting frame metadata) triggers the unchecked EOFB writes past the one-byte strip buffer, terminating the process.
**Insight:** Compression encoders that size output buffers from pixel dimensions but append fixed-size terminators (EOFB/EOL codes) are off-by-design for minimal images; test 1x1 and single-row strips against every fax/CCITT codec path, especially when encoder settings are inherited from decoded metadata.