imagecodecs 2023.1.23 through 2026.10.10 Stack Buffer Overflow via jpegsof3_decode()
Affects imagecodecs 2023.1.23 through 2026.10.10 when jpegsof3_decode() is passed a crafted lossless JPEG (SOF3) input. No fixed release is listed in the checked facts.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 17/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The imagecodecs Python library, which is used to encode and decode image formats, is affected by a stack buffer overflow in its lossless JPEG decoder. A specially crafted lossless JPEG file can corrupt memory during decoding, causing the program that opens it to crash.
Read the original description
imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG Define Huffman Table parser in decode_jpegsof3(). Attackers can supply a crafted lossless JPEG whose DHT symbol counts wrap an 8-bit sum, overflowing the 32-entry HufVal and HufSz stack arrays and crashing the calling process.
What to do
Check whether your setup matches what the bug needs.
Affected imagecodecs version as reported (the CVE range is 2023.1.23 through 2026.10.10; the advisory reproduces it on 2026.10.10) The crafted lossless JPEG (SOF3) input must be passed to jpegsof3_decode()Workaround: While no fix is published, limit jpegsof3_decode() to trusted input only, since the crash requires a crafted SOF3 file passed to that function.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- cgohlke imagecodecs
From 2023.1.23 · through 2026.10.10
Evidence 4
- Report
- Repository
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-120252
What does this mean?
Passing a crafted lossless JPEG (SOF3) input to jpegsof3_decode() causes a stack buffer overflow that crashes the calling process with SIGSEGV. The advisory describes this as a denial of service, not code execution.Source: github.com
Am I affected, and how do I check?
The CVE range is imagecodecs 2023.1.23 through 2026.10.10, and the advisory reproduces it on 2026.10.10 with CPython 3.14 on x86-64 Linux. To check an installed version, run python -c "import imagecodecs; print(imagecodecs.__version__)".Source: github.com
What should I do about it?
The checked facts do not name a fixed release, so no upgrade target can be given. Until one is confirmed, avoid passing untrusted lossless JPEG (SOF3) data to jpegsof3_decode().Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What if there's no patch?
While no fix is published, limit jpegsof3_decode() to trusted input only, since the crash requires a crafted SOF3 file passed to that function.Source: github.com