CVE-2025-54575: ImageSharp GIF Decoder DOS Vulnerability

CVE-2025-54575 Overview

CVE-2025-54575 is a denial of service vulnerability in ImageSharp, a widely used 2D graphics library for .NET. The flaw resides in the GIF decoder's handling of comment extension blocks. A specially crafted GIF file containing a malformed comment extension block with a missing block terminator causes the decoder to enter an infinite loop while attempting to skip the block. The issue affects ImageSharp versions below 2.1.11 and versions 3.0.0 through 3.1.10. Applications that process untrusted GIF input are exposed to resource exhaustion, and maintainers have released fixed versions 2.1.11 and 3.1.11.

Critical Impact
Remote attackers can trigger an infinite loop in the ImageSharp GIF decoder by supplying a malformed GIF, causing CPU exhaustion and denial of service in any application that decodes untrusted GIF input.

Affected Products

SixLabors ImageSharp versions below 2.1.11
SixLabors ImageSharp versions 3.0.0 through 3.1.10
.NET applications and services that decode untrusted GIF input using ImageSharp

Discovery Timeline

2025-07-30 - CVE-2025-54575 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54575

Vulnerability Analysis

The vulnerability is classified as uncontrolled resource consumption [CWE-400] in the ImageSharp GIF decoder. GIF files use a chained series of sub-blocks for comment extensions, where each sub-block starts with a length byte and the sequence terminates with a zero-length block. The decoder reads each sub-block length and advances the stream accordingly.

When the input stream ends before a proper terminator is encountered, the read operation returns -1. The pre-patch decoder did not treat this end-of-stream condition as an error. Instead, the loop continued to request the next sub-block length, repeatedly receiving -1, and never advanced the underlying stream. This results in an infinite loop that consumes a full CPU core per decoding thread.

Root Cause

The root cause is missing end-of-stream validation inside the GIF comment sub-block skip logic in src/ImageSharp/Formats/Gif/GifDecoderCore.cs. The code checked for a maximum length but did not check whether the underlying stream reader had returned -1 to signal EOF.

Attack Vector

Exploitation requires no authentication or user interaction. An attacker submits a crafted GIF to any endpoint that hands untrusted image bytes to Image.Load, Image.Identify, or a similar ImageSharp API. Common exposure paths include avatar uploads, image thumbnail generation, document processing pipelines, and content moderation services.

text

// Patch: src/ImageSharp/Formats/Gif/GifDecoderCore.cs
                GifThrowHelper.ThrowInvalidImageContentException($"Gif comment length '{length}' exceeds max '{GifConstants.MaxCommentSubBlockLength}' of a comment data block");
            }

+            if (length == -1)
+            {
+                GifThrowHelper.ThrowInvalidImageContentException("Unexpected end of stream while reading gif comment");
+            }

            if (this.skipMetadata)
            {
                stream.Seek(length, SeekOrigin.Current);

Source: GitHub ImageSharp Commit 833f3ce. The added check raises ThrowInvalidImageContentException when the length byte read returns -1, breaking the infinite loop path.

Detection Methods for CVE-2025-54575

Indicators of Compromise

Worker processes or web application threads pinned at 100% CPU utilization shortly after receiving image upload traffic.
Application logs showing stalled or timed-out GIF decoding operations invoking SixLabors.ImageSharp.Formats.Gif.GifDecoderCore.
Truncated GIF payloads whose comment extension blocks (0x21 0xFE) are not terminated with a 0x00 block terminator.
Sudden growth in request queue depth or thread pool starvation on services that accept user-supplied images.

Detection Strategies

Inventory .NET dependencies using SBOM tooling and flag SixLabors.ImageSharp at versions below 2.1.11 or between 3.0.0 and 3.1.10.
Add unit or integration tests that decode a known-malformed GIF fixture under a strict timeout to confirm patched behavior.
Instrument image-decoding code paths with per-operation timers and raise alerts when decoding exceeds a defined threshold.

Monitoring Recommendations

Monitor CPU utilization and thread state of image-processing services and correlate spikes with recent upload activity.
Log every ImageSharp exception, especially InvalidImageContentException, and alert on repeated occurrences from the same source.
Track upstream advisory GHSA-rxmq-m78w-7wmc and dependency scanner findings for continued exposure across environments.

How to Mitigate CVE-2025-54575

Immediate Actions Required

Upgrade SixLabors.ImageSharp to version 2.1.11 for the 2.x branch or 3.1.11 for the 3.x branch.
Audit all services that accept user-supplied images and confirm the ImageSharp version resolved at build time, not only the declared version.
Apply request-level timeouts and CPU quotas to image-decoding endpoints until the patched library is deployed.

Patch Information

The fix is delivered in the upstream commits 55e4926 and 833f3ce, and documented in GitHub Security Advisory GHSA-rxmq-m78w-7wmc. Both patches add an end-of-stream check that throws InvalidImageContentException instead of looping. Additional context is available in the GitHub ImageSharp Issue #2953 discussion.

Workarounds

Reject GIF uploads at the application or WAF layer until the ImageSharp dependency is upgraded.
Execute GIF decoding inside a sandboxed process with a hard CPU time limit so an infinite loop is terminated automatically.
Wrap ImageSharp decode calls in a cancellation token with a strict deadline and surface a decoding error to the caller when the deadline expires.

bash

# Upgrade ImageSharp to a patched version
dotnet add package SixLabors.ImageSharp --version 3.1.11

# For projects still on the 2.x branch
dotnet add package SixLabors.ImageSharp --version 2.1.11

# Verify the resolved version across the solution
dotnet list package --include-transitive | grep -i ImageSharp