CVE-2026-120252
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow in the lossless JPEG Define Huffman Table parser in decode_jpegsof3(). A crafted file can overflow the 32-entry HufVal and HufSz stack arrays and crash the calling process.
Risk Assessment
An attacker can supply a crafted JPEG image, causing the processing process to crash. This may lead to denial of service in applications that process untrusted images.
Recommendation
Update imagecodecs to a version that contains the fix. Until then, avoid processing untrusted JPEG files in applications using this library.
Other vulnerabilities in imagecodecs
Original NVD description (English source)
imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG Define Huffman Table parser in decode_jpegsof3(). Attackers can supply a crafted lossless JPEG whose DHT symbol counts wrap an 8-bit sum, overflowing the 32-entry HufVal and HufSz stack arrays and crashing the calling process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS