{"id":"CVE-2026-120251","kind":"vulnerability","aliases":["CVE-2026-120251"],"related":[],"title":"imagecodecs: crafted CCITT Group 4 stream hangs decoding process indefinitely","description":"imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt_fax4_decode_size() that allows attackers to hang the calling process by supplying a crafted CCITT Group 4 stream. Attackers can provide an 8-byte G4 stream lacking EOFB to ccittfax4_decode() or the numcodecs Ccittfax4 codec, consuming full CPU until the process is killed.","summary":"imagecodecs versions 2026.3.6 through 2026.10.10 loop forever in ccitt_fax4_decode_size() when given a crafted CCITT Group 4 image stream. An attacker can pin a CPU core until the calling process is killed.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["image-processing","imagecodecs","numcodecs","package","python"],"not_affected_if":["no-ccitt-codec","no-untrusted-input","version-outside-range"],"how_to_check":"- Run `python -m pip show imagecodecs` and check whether the version is between `2026.3.6` and `2026.10.10`.\n- Search dependency lockfiles and requirements for `imagecodecs` and for `numcodecs` codecs using `Ccittfax4`.","fix":"- Move to a version of imagecodecs later than `2026.10.10`; the sources do not name the exact fixed release.","status":"open","published_at":"2026-11-01T01:17:19+00:00","first_seen_at":"2026-11-01T01:47:22+00:00","triaged_at":"2026-11-01T01:47:39+00:00","updated_at":"2026-11-01T01:47:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-01T01:47:39Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version of imagecodecs later than `2026.10.10`; the sources do not name the exact fixed release.","reach":"unknown","title":"imagecodecs: crafted CCITT Group 4 stream hangs decoding process indefinitely","impact":"low","summary":"imagecodecs versions 2026.3.6 through 2026.10.10 loop forever in ccitt_fax4_decode_size() when given a crafted CCITT Group 4 image stream. An attacker can pin a CPU core until the calling process is killed.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","imagecodecs","numcodecs","image-processing"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker hangs the process and consumes a full CPU core","analyst_note":"","how_to_check":"- Run `python -m pip show imagecodecs` and check whether the version is between `2026.3.6` and `2026.10.10`.\n- Search dependency lockfiles and requirements for `imagecodecs` and for `numcodecs` codecs using `Ccittfax4`.","plain_action":"","needs_analyst":false,"not_affected_if":["version-outside-range","no-untrusted-input","no-ccitt-codec"],"who_is_affected":"Applications that decode untrusted CCITT Group 4 data with imagecodecs, including through the ccittfax4_decode() function or the numcodecs Ccittfax4 codec, are exposed. Services that only process their own trusted images are unlikely to be reached by an attacker. unknown whether any other code path is affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000718,"input_tokens":4193,"output_tokens":597,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120251':13A,16A '-2026':12A,15A '2026.10.10':28B,61C '2026.3.6':26B,59C '4':5A,42B,86C '8':92C 'allow':73C 'attack':46B,74C,88C 'byte':93C 'call':54B,78C 'ccitt':3A,32B,40B,68C,84C 'ccittfax4':99C,104C 'codec':105C 'consum':106C 'contain':62C 'core':51B 'cpu':50B,108C 'craft':2A,39B,83C 'cve':11A,14A 'decod':8A,34B,70C,100C 'eofb':97C 'fax4':33B,69C 'forev':30B 'full':107C 'g4':94C 'given':37B 'group':4A,41B,85C 'hang':7A,76C 'imag':18B,43B 'image-process':17B 'imagecodec':1A,20B,24B,58C 'indefinit':10A 'infinit':64C 'kill':57B,113C 'lack':96C 'loop':29B,65C 'numcodec':21B,103C 'packag':22B 'pin':48B 'process':9A,19B,55B,79C,111C 'provid':90C 'python':23B 'size':35B,71C 'stream':6A,44B,87C,95C 'suppli':81C 'version':25B 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Applications that decode untrusted CCITT Group 4 data with imagecodecs, including through the ccittfax4_decode() function or the numcodecs Ccittfax4 codec, are exposed. Services that only process their own trusted images are unlikely to be reached by an attacker. unknown whether any other code path is affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-11-01T01:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120251","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120251","severity":null,"published_at":"2026-11-01T01:17:19+00:00","modified_at":"2026-11-01T01:17:19+00:00","first_seen_at":"2026-11-01T01:47:22+00:00","fetched_at":"2026-11-01T01:47:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}