CVE-2024-32036

ImageSharp is a 2D graphics API. A data leakage flaw was found in ImageSharp's JPEG and TGA decoders. This vulnerability is triggered when an attacker passes a specially crafted JPEG or TGA image file to a software using ImageSharp, potentially disclosing sensitive information from other parts of the software in the resulting image buffer. The problem has been patched in v3.1.4 and v2.1.8.

• CWE-226
• CWE-212

• https://github.com/SixLabors/ImageSharp/commit/8f0b4d3e680e78d479a88e7b1472bccd8f096d68Patch
• https://github.com/SixLabors/ImageSharp/commit/da5f09a42513489fe359578d81cec2f15ba588baPatch
• https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-5x7m-6737-26crVendor Advisory
• https://github.com/SixLabors/ImageSharp/commit/8f0b4d3e680e78d479a88e7b1472bccd8f096d68Patch
• https://github.com/SixLabors/ImageSharp/commit/da5f09a42513489fe359578d81cec2f15ba588baPatch
• https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-5x7m-6737-26crVendor Advisory

Published

Apr 15, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-32028OpenTelemetry dotnet is a dotnet telemetry framework. In aff…4.1
• CVE-2024-32029Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2024-3203A vulnerability, which was classified as critical, was found…9.8
• CVE-2024-32030Kafka UI is an Open-Source Web UI for Apache Kafka Managemen…8.1
• CVE-2024-32034decidim is a Free Open-Source participatory democracy, citiz…4.8
• CVE-2024-32035ImageSharp is a 2D graphics API. A vulnerability discovered …6.5
• CVE-2024-32037GeoNetwork is a catalog application to manage spatially refe…5.3
• CVE-2024-32038Wazuh is a free and open source platform used for threat pre…9.8
• CVE-2024-32039FreeRDP is a free implementation of the Remote Desktop Proto…9.8
• CVE-2024-3204A vulnerability has been found in c-blosc2 up to 2.13.2 and …9.8
• CVE-2024-32040FreeRDP is a free implementation of the Remote Desktop Proto…9.8
• CVE-2024-32041FreeRDP is a free implementation of the Remote Desktop Proto…9.8