GitHub Advisoryadvisory · NuGet

GHSA-rxmq-m78w-7wmc SixLabors ImageSharp Has Infinite Loop in GIF Decoder When Skipping Malformed Comment Extension Blocks

MEDIUM Published 2025-07-30 Modified 2025-07-31 Official page ↗
Aliases
CVE-2025-54575
Ecosystem
NuGet
Packages
SixLabors.ImageSharp
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-400, CWE-770
Reviewed
2025-07-30

Affected packages

• NuGet SixLabors.ImageSharp: < 2.1.11 → fixed in 2.1.11 • NuGet SixLabors.ImageSharp: >= 3.0.0, < 3.1.11 → fixed in 3.1.11

Description

Impact A specially crafted GIF file containing a malformed comment extension block (with a missing block terminator) can cause the ImageSharp GIF decoder to enter an infinite loop while attempting to skip the block. This leads to a denial of service. Applications processing untrusted GIF input should upgrade to a patched version. Patches The problem has been patched. All users are advised to upgrade to v3.1.11 or v2.1.11. Workarounds None.

Related

Alias · CVE (1)

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References