Upgrading SixLabors.ImageSharp 3 to 4
Breaking3.2.0 → 4.1.3Breaking4Security10New35Changed37Fixed71Other36
SecurityHigh · CVSS 7.5ImageSharp: ICC LUT16 output channel count can write beyond Vector4GHSA-ffp7-56pq-64mr · CVE-2026-106112 ↗
BreakingUpgrade verdict
4 breaking changes and 9 security fixes.
In plain terms
- The AntialiasThreshold setting is no longer available on GraphicsOptions.
- Removes ExifTagValue.InteroperabilityIndex.
- The way PNG CRC chunk errors are handled has been replaced with a new API.
- Code that set the old antialiasing depth option must switch to the new threshold option.
Must act Top 5 of 13 that need code or config changes
Target frameworks requirement changed in 4.0.0: net6.0 → net8.0.
What you must change
Breaking4
Removes AntialiasThreshold from GraphicsOptions.
GraphicsOptionsAntialiasThresholdRemoves ExifTagValue.InteroperabilityIndex.
ExifTagValue.InteroperabilityIndexReplaces PngCrcChunkHandling.
PngCrcChunkHandlingReplaces AntialiasSubpixelDepth with AntialiasThreshold.
AntialiasSubpixelDepthAntialiasThresholdSecurity9
ImageSharp: ICC LUT16 output channel count can write beyond Vector4
High · CVSS 7.5ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer
High · CVSS 7.5ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions
Moderate · CVSS 5.3ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
High · CVSS 7.5ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index
High · CVSS 7.5ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop
Moderate · CVSS 5.3ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate
Moderate · CVSS 5.9ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write
High · CVSS 7.5Fixes integer overflow and bounds-checking vulnerabilities in the EXR decoder.