CVE-2025-54575 ImageSharp Triggers an Infinite Loop in its GIF Decoder When Skipping Malformed Comment Extension Blocks
Attackers can cause a denial of service in applications using ImageSharp by submitting a specially crafted GIF file that triggers an infinite loop in the decoder.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-54575?
CVE-2025-54575 is a medium-severity denial of service vulnerability in SixLabors ImageSharp, published on 30 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ImageSharp is a 2D graphics library. In versions below 2.1.11 and 3.0.0 through 3.1.10, a specially crafted GIF file containing a malformed comment extension block (with a missing block terminator) can cause the ImageSharp GIF decoder to enter an infinite loop while attempting to skip the block. This leads to a denial of service. Applications processing untrusted GIF input should upgrade to a patched version. This issue is fixed in versions 2.1.11 and 3.1.11.
Which versions are affected by CVE-2025-54575?
4 open source packages ship an affected version, including SixLabors.ImageSharp.
| Package | Affected | Fixed in |
|---|---|---|
SixLabors.ImageSharp NuGet | All versions | 2.1.11 |
SixLabors.ImageSharp NuGet | All versions | 2.1.11 |
SixLabors.ImageSharp NuGet | From 3.0.0 | 3.1.11 |
SixLabors.ImageSharp NuGet | From 3.0.0 | 3.1.11 |
How do I fix CVE-2025-54575?
Upgrade SixLabors.ImageSharp to a fixed version for your release line: 2.1.11 or 3.1.11.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-54575 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54575 exists.
Sources
Also known as ECHO-fffa-11ee-e557, GHSA-rxmq-m78w-7wmc.