PT-2026-134692
CVE-2026-120251
·
Published
2026-11-01
·
Updated
2026-11-01
Description by
CVSS 3.1
5.5
MediumMetricsAV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt fax4 decode size() that allows attackers to hang the calling process by supplying a crafted CCITT Group 4 stream. Attackers can provide an 8-byte G4 stream lacking EOFB to ccittfax4 decode() or the numcodecs Ccittfax4 codec, consuming full CPU until the process is killed.
Found an issue in the description? Have something to add? Feel free to write us 👾