CVE-2025-54575

MEDIUM

Nuget Sixlabors.imagesharp < 2.1.11 - Denial of Service

Title source: rule
STIX 2.1

Description

ImageSharp is a 2D graphics library. In versions below 2.1.11 and 3.0.0 through 3.1.10, a specially crafted GIF file containing a malformed comment extension block (with a missing block terminator) can cause the ImageSharp GIF decoder to enter an infinite loop while attempting to skip the block. This leads to a denial of service. Applications processing untrusted GIF input should upgrade to a patched version. This issue is fixed in versions 2.1.11 and 3.1.11.

References (4)

Core 4

Scores

CVSS v3 5.3
EPSS 0.0012
EPSS Percentile 31.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-400 CWE-770
Status published
Products (3)
nuget/SixLabors.ImageSharp 0 - 2.1.11NuGet
SixLabors/ImageSharp < 2.1.11
SixLabors/ImageSharp >= 3.0.0, < 3.1.11
Published Jul 30, 2025
Tracked Since Feb 18, 2026