CVE-2024-41131: Sixlabors ImageSharp DoS Vulnerability

CVE-2024-41131 Overview

CVE-2024-41131 is an out-of-bounds write vulnerability [CWE-787] in the GIF decoder of SixLabors ImageSharp, a widely used 2D graphics API for .NET. Attackers can trigger a crash by supplying a specially crafted GIF file to any application that processes images through the vulnerable decoder. Successful exploitation results in denial of service against the host process. The flaw resides in the LZW decoding logic used during GIF parsing. Maintainers have released fixed versions 3.1.5 and 2.1.9, and all users are advised to upgrade.

Critical Impact

A network-reachable attacker can crash any application that decodes untrusted GIF images using ImageSharp, with no authentication or user interaction required.

Affected Products

• SixLabors ImageSharp versions prior to 2.1.9 (2.x branch)
• SixLabors ImageSharp versions prior to 3.1.5 (3.x branch)
• Applications and services embedding the SixLabors.ImageSharp NuGet package for GIF processing

Discovery Timeline

• 2024-07-22 - CVE-2024-41131 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-41131

Vulnerability Analysis

The vulnerability resides in src/ImageSharp/Formats/Gif/LzwDecoder.cs, the component responsible for decompressing Lempel-Ziv-Welch (LZW) encoded GIF image data. The decoder failed to enforce the GIF specification limit of 12 bits for LZW codes. By supplying a malformed GIF that drives the code size beyond this boundary, an attacker forces the decoder to write past the bounds of its internal fixed-size buffers. The result is memory corruption that crashes the hosting process. Because ImageSharp is commonly used in web servers, document processing pipelines, and SaaS image upload features, the attack surface is reachable over the network through standard image upload functionality.

Root Cause

The decoder did not validate the LZW code size against the GIF format's hard ceiling of 12 bits. Without this check, attacker-controlled code lengths drove array indices beyond allocated buffer sizes, producing an out-of-bounds write classified as [CWE-787].

Attack Vector

An unauthenticated remote attacker uploads or otherwise submits a crafted GIF to any endpoint that invokes ImageSharp's GIF decoder. No user interaction is required beyond the server-side image processing. The outcome is a process crash and denial of service for downstream consumers.

     /// </summary>
     private const int MaxStackSize = 4096;
 
+    /// <summary>
+    /// The maximum bits for a lzw code.
+    /// </summary>
+    private const int MaximumLzwBits = 12;
+
     /// <summary>
     /// The null code.
     /// </summary>

Source: GitHub Commit 9dda64a8 — LzwDecoder.cs patch

The patch introduces a MaximumLzwBits constant set to 12, which the decoder uses to bound code size and prevent writes outside the LZW prefix and suffix tables.

Detection Methods for CVE-2024-41131

Indicators of Compromise

• Unexpected crashes or unhandled exceptions in .NET processes that perform GIF decoding through SixLabors.ImageSharp
• Repeated process restarts of image processing workers shortly after receiving GIF uploads
• Stack traces referencing LzwDecoder or GifDecoderCore in application logs

Detection Strategies

• Inventory all .NET applications and container images for the SixLabors.ImageSharp package and compare resolved versions against 2.1.9 and 3.1.5.
• Use software composition analysis (SCA) tools to flag vulnerable SixLabors.ImageSharp versions in build artifacts and dependency manifests.
• Monitor upload endpoints for GIF files that produce decoder exceptions and correlate with source IPs for repeat behavior.

Monitoring Recommendations

• Alert on abnormal restart rates or crash dumps from image processing services and worker pools.
• Log MIME type, file size, and decode duration for inbound images to identify outlier GIF submissions.
• Capture and review unhandled exceptions originating from the SixLabors.ImageSharp.Formats.Gif namespace.

How to Mitigate CVE-2024-41131

Immediate Actions Required

• Upgrade SixLabors.ImageSharp to version 3.1.5 for 3.x deployments or 2.1.9 for 2.x deployments.
• Rebuild and redeploy all container images, serverless functions, and application binaries that statically reference the vulnerable package.
• Restrict and rate-limit untrusted image uploads until patched builds are in production.

Patch Information

The fix is delivered in commits 9dda64a8 and a1f28797, corresponding to pull requests #2754 and #2756. Full advisory details are published as GHSA-63p8-c4ww-9cg7. Upgrade to ImageSharp 3.1.5 or 2.1.9 to remediate.

Workarounds

• Disable GIF decoding in application configuration where the format is not required by removing the GIF decoder from the configured image formats.
• Validate image format and structural integrity using an isolated sandbox or sidecar service before passing files to ImageSharp.
• Run image processing in a hardened, restartable worker process so a crash does not impact the broader application.

# Update the vulnerable package in a .NET project
dotnet add package SixLabors.ImageSharp --version 3.1.5

# Verify the installed version
dotnet list package | grep SixLabors.ImageSharp