Live › vulnerability › CVE-2026-120252
imagecodecs is a Python library for decoding image formats, and its lossless JPEG decoder mishandles a crafted Define Huffman Table segment. A specially crafted lossless JPEG overflows a stack buffer in decode_jpegsof3() and crashes the calling process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 01:47 UTC. All times on this page are UTC.
Applications that call imagecodecs to decode lossless JPEG files from untrusted sources are exposed, since a crafted file can crash the process that decodes it. Services that only process trusted images or do not use the lossless JPEG decoder can skip it. The sources do not state a fixed version.
No product ranges from the sources yet.
pip show imagecodecs and see whether it falls in 2023.1.23 through 2026.10.10.imagecodecs to find services that decode untrusted JPEG input.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG Define Huffman Table parser in decode_jpegsof3(). Attackers can supply a crafted lossless JPEG whose DHT symbol counts wrap an 8-bit sum, overflowing the 32-entry HufVal and HufSz stack arrays and crashing the calling process.
This page as .md · .json · in your agent: get_signal("CVE-2026-120252")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.