CVE-2026-58641

Overview

SkiaSharp is a cross-platform 2D graphics library for .NET that binds Google's Skia rendering engine. HeroDevs NES Essentials Plus maintains a SkiaSharp fork for .NET environments that need continued security fixes after End-of-Life while staying on the NES package line.

An elevation of privilege vulnerability (CVE-2026-58641) has been identified in SkiaSharp's image buffer size arithmetic. SKImageInfo.BytesSize and SKImageInfo.RowBytes computed byte counts in 32-bit signed arithmetic that could wrap, so an application sizing a pinned managed buffer from those values could allocate far less memory than the image required.

Per CWE-190: Integer Overflow or Wraparound, the weakness is a product performing a calculation that can produce an integer overflow or wraparound when the logic assumes the resulting value will always be larger than the original. The undersized allocation is then overrun by native decoding, which is CWE-787: Out-of-bounds Write.

SkiaSharp is versioned independently of .NET and is not part of the .NET shared framework, so exposure follows the SkiaSharp package version rather than the runtime version. Exploitation requires a local attack vector and user interaction, meaning a user must open or load a crafted image.

‍

Details

Module Info

• Product: SkiaSharp
• Affected packages: SkiaSharp (an independently versioned NuGet package, not part of the .NET shared framework)
• Affected versions:
  • SkiaSharp < 4.148.0
  • NES Essentials Plus SkiaSharp 3.116.1.x < 3.116.1.2
• Package manager: NuGet
• GitHub repository: https://github.com/mono/SkiaSharp
• Published packages: SkiaSharp on NuGet
• Fixed in: NES Essentials Plus SkiaSharp 3.116.1.2

Vulnerability Info

This High-severity vulnerability is found in the SkiaSharp package in versions before 4.148.0, and in the NES Essentials Plus fork in the 3.116.1.x line before 3.116.1.2.

SKImageInfo describes an image's dimensions and color type, and its BytesSize and RowBytes members report how many bytes a caller must allocate to hold the decoded pixels. Both computed that figure with unchecked 32-bit signed arithmetic. An image whose width, height and bytes-per-pixel multiply past int.MaxValue wrapped the result to a small or negative number; a 32768x32768 RGBA image wrapped to a zero-length buffer. Callers that pinned a managed byte[] sized from BytesSize therefore handed native decoding a buffer far smaller than the image, and the decode wrote past its end.

The fix applies checked arithmetic at three sites, BytesSize, RowBytes, and the internal pixel-offset helper, so an overflowing image raises OverflowException instead of returning a wrapped size. Callers that need true sizes for very large images should use the existing BytesSize64 and RowBytes64 members, which are unaffected by the change.

The advisory's lower bound is open (< 4.148.0), so the weakness is present in every earlier SkiaSharp release, including the whole 3.116.1.x line the NES fork tracks.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • SkiaSharp >= 4.148.0
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES Essentials Plus SkiaSharp 3.116.1.2 or later.

‍

Credits

Microsoft did not publicly credit an individual finder for this vulnerability in its security advisory.