Vulnerability Reportlinuxserver/radarr:latest

linuxserver/radarr:latestlinuxserver/radarr:6.4.4linuxserver/radarr:version-6.4.4.10685linuxserver/radarr:6.4.4.10685-ls325

digestsha256:ade5937813c6ae415b29db729386e53fea3ecf067a019849bafbe2d2a6ec02ba

Executive Summary

Last scanned: Nov 4, 2026

Threat ScoreNEEDS ATTENTION• CVE-2026-106118 in the SixLabors.ImageSharp package (version 3.1.12) is the top finding, rated 6.0. It could cause heap memory corruption from a crafted tiled fax TIFF, which may crash Radarr or allow code execution if such an image is ever decoded.• The scan found 8 exposed findings in total, 2 of them at severity 6.0 or higher and none at 7.0 or above. None are listed as known to be actively exploited.• CVE-2026-106118 needs a special configuration: a tiled fax-compressed TIFF must be decoded, which is not a normal Radarr workflow, so practical exposure is limited.• CVE-2026-84008 in the System.Security.Cryptography.Pkcs package (version 8.0.1) is a denial-of-service flaw rated 6.0. It could slow or hang Radarr, but it is unclear whether Radarr parses such structures from network input, so real exposure is uncertain.• No post-exploit-only findings were reported, and the image publisher carries a TRUSTED verdict with the image pinned by digest.

27/100NEEDS ATTENTION

ReputationSPONSORED OSS• Docker Sponsored OSS (Trusted Community)• Pinned by digest (Immutable)

TRUSTED

This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The scan found 8 exposed findings, 2 of them rated 6.0 or higher, and none known to be actively exploited. The most notable is CVE-2026-106118 in the ImageSharp library, which could allow heap corruption and possibly code execution, but it only applies if Radarr decodes fax-compressed tiled TIFF images, which is not a normal workflow. CVE-2026-84008 in the cryptography library could cause temporary unavailability through crafted input, though its exposure in Radarr is uncertain. Updating these packages in a future image build is the practical way to reduce the attack surface.

Hardening plan for this image · 3 steps

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

8 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-106118	MEDIUM6	SixLabors.ImageSharp 3.1.12 fixed in 3.2.0, 4.1.1	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-84008	MEDIUM6	System.Security.Cryptography.Pkcs 8.0.1 fixed in 10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21	1.0% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-70162	MEDIUM5.9	System.Security.Cryptography.Pkcs 8.0.1 fixed in 10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21	0.9% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-106110	MEDIUM4.5	SixLabors.ImageSharp 3.1.12 fixed in 3.2.0, 4.1.2	0.4% Theoretical Threat	Directly Exposed
CVE-2026-106113	MEDIUM4.5	SixLabors.ImageSharp 3.1.12 fixed in 3.2.0, 4.1.2	0.4% Theoretical Threat	Directly Exposed
CVE-2026-106115	MEDIUM4.5	SixLabors.ImageSharp 3.1.12 fixed in 3.2.0, 4.1.2	0.4% Theoretical Threat	Directly Exposed
CVE-2026-106114	LOW3.18	SixLabors.ImageSharp 3.1.12 fixed in 4.1.2, 3.2.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-106116	LOW3.18	SixLabors.ImageSharp 3.1.12 fixed in 3.2.0, 4.1.2	0.3% Theoretical Threat	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.