PT-2026-134692

CVE-2026-120251

Published

2026-11-01

Updated

2026-11-03

Description by

CVSS 4.0

6.8

Medium

MetricsAV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions imagecodecs versions 2026.3.6 through 2026.10.10

Description An infinite loop occurs in the ccitt fax4 decode size() function when processing a specially crafted CCITT Group 4 stream. An attacker can cause the calling process to hang and consume full CPU resources by providing an 8-byte G4 stream that lacks an End of File Block (EOFB) to the ccittfax4 decode() function or the numcodecs Ccittfax4 codec.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Dilanka Kaushal Hewage

R3Vpwnx

Vendors

Affected products

Weakness enumeration

CWE-835: Loop with Unreachable Exit Condition (\'Infinite Loop\')

Related identifiers