Updated IronSoftware.System.Drawing to 2026.11.5 and added .NET 6 and .NET 8 builds. On .NET 8+ IronQR uses SixLabors.ImageSharp 4.1.3, which fixes CVE-2026-106110 through CVE-2026-106116. .NET 6 (ImageSharp 3.2.0) and .NET Standard 2.0 including .NET Framework (ImageSharp 2.1.13) do not include the fix.
.NET Framework / .NET Standard 2.0: images are now checked before they are decoded, blocking malformed BigTIFF data that makes SixLabors.ImageSharp 2.1.13 hang (CVE-2026-106116). Six Labors no longer patches ImageSharp 2.x.
The other ImageSharp 2.x advisories (CVE-2026-106110, CVE-2026-106113, CVE-2026-106114, CVE-2026-106115) are not reachable through IronQR APIs. Applications that call SixLabors.ImageSharp directly should not use HistogramEqualization, the CCITT TiffEncoder compressions or IccProfile.Entries on untrusted files.