{"id":"CVE-2026-120252","kind":"vulnerability","aliases":["CVE-2026-120252"],"related":[],"title":"imagecodecs: crafted lossless JPEG overflows stack and crashes the process","description":"imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG Define Huffman Table parser in decode_jpegsof3(). Attackers can supply a crafted lossless JPEG whose DHT symbol counts wrap an 8-bit sum, overflowing the 32-entry HufVal and HufSz stack arrays and crashing the calling process.","summary":"imagecodecs is a Python library for decoding image formats, and its lossless JPEG decoder mishandles a crafted Define Huffman Table segment. A specially crafted lossless JPEG overflows a stack buffer in decode_jpegsof3() and crashes the calling process.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["imagecodecs","package","python"],"not_affected_if":["lossless-jpeg-unused","trusted-input-only"],"how_to_check":"- Check the installed version with `pip show imagecodecs` and see whether it falls in 2023.1.23 through 2026.10.10.\n- Search dependency manifests and lockfiles for `imagecodecs` to find services that decode untrusted JPEG input.","fix":null,"status":"open","published_at":"2026-11-01T01:17:19+00:00","first_seen_at":"2026-11-01T01:47:22+00:00","triaged_at":"2026-11-01T01:47:34+00:00","updated_at":"2026-11-01T01:47:34+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-01T01:47:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"imagecodecs: crafted lossless JPEG overflows stack and crashes the process","impact":"low","summary":"imagecodecs is a Python library for decoding image formats, and its lossless JPEG decoder mishandles a crafted Define Huffman Table segment. A specially crafted lossless JPEG overflows a stack buffer in decode_jpegsof3() and crashes the calling process.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","imagecodecs"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker crashes the decoding process with a crafted image file","analyst_note":"Check the NVD entry and the imagecodecs project for a fixed release version and whether a crash is the only outcome of the overflow.","how_to_check":"- Check the installed version with `pip show imagecodecs` and see whether it falls in 2023.1.23 through 2026.10.10.\n- Search dependency manifests and lockfiles for `imagecodecs` to find services that decode untrusted JPEG input.","plain_action":"","needs_analyst":true,"not_affected_if":["trusted-input-only","lossless-jpeg-unused"],"who_is_affected":"Applications that call imagecodecs to decode lossless JPEG files from untrusted sources are exposed, since a crafted file can crash the process that decodes it. Services that only process trusted images or do not use the lossless JPEG decoder can skip it. The sources do not state a fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000705,"input_tokens":4184,"output_tokens":574,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120252':13A,16A '-2026':12A,15A '2023.1.23':59C '2026.10.10':61C '32':99C '8':94C 'array':105C 'attack':81C 'base':66C 'bit':95C 'buffer':49B,67C 'call':56B,109C 'contain':62C 'count':91C 'craft':2A,36B,43B,85C 'crash':8A,54B,107C 'cve':11A,14A 'decod':26B,33B,51B,79C 'defin':37B,74C 'dht':89C 'entri':100C 'format':28B 'huffman':38B,75C 'hufsz':103C 'hufval':101C 'imag':27B 'imagecodec':1A,17B,20B,58C 'jpeg':4A,32B,45B,73C,87C 'jpegsof3':52B,80C 'librari':24B 'lossless':3A,31B,44B,72C,86C 'mishandl':34B 'overflow':5A,46B,68C,97C 'packag':18B 'parser':77C 'process':10A,57B,110C 'python':19B,23B 'segment':40B 'special':42B 'stack':6A,48B,65C,104C 'stack-bas':64C 'sum':96C 'suppli':83C 'symbol':90C 'tabl':39B,76C 'vulner':69C 'whose':88C 'wrap':92C","nicknames":[],"mitigations":[],"who_affected":"Applications that call imagecodecs to decode lossless JPEG files from untrusted sources are exposed, since a crafted file can crash the process that decodes it. Services that only process trusted images or do not use the lossless JPEG decoder can skip it. The sources do not state a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-11-01T01:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120252","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120252","severity":null,"published_at":"2026-11-01T01:17:19+00:00","modified_at":"2026-11-01T01:17:19+00:00","first_seen_at":"2026-11-01T01:47:22+00:00","fetched_at":"2026-11-01T01:47:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}