CVE-2026-120251

MediumCVSS 5.5

Published: 01/11/2026(UTC)Updated: 02/11/2026(UTC)Translated: 01/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt_fax4_decode_size(). An attacker can supply a crafted CCITT Group 4 stream lacking EOFB, causing the calling process to hang and consume full CPU.

Risk Assessment

A malicious file can hang the processing process and exhaust CPU resources. This leads to denial of service in applications decoding untrusted fax images.

Recommendation

Update imagecodecs to a version with the fix. Until then, limit processing of untrusted CCITT Group 4 streams.

Other vulnerabilities in imagecodecs

CVE-2026-120252Medium
imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow in the lossless JPEG Define Huffman Table parser in decode_jpegsof3(). A crafted file can overflow the 32-entry HufVal and HufSz stack arrays and crash the calling process.

Original NVD description (English source)

imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt_fax4_decode_size() that allows attackers to hang the calling process by supplying a crafted CCITT Group 4 stream. Attackers can provide an 8-byte G4 stream lacking EOFB to ccittfax4_decode() or the numcodecs Ccittfax4 codec, consuming full CPU until the process is killed.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS