CVE-2026-120252

Name of the Vulnerable Software and Affected Versions imagecodecs versions 2023.1.23 through 2026.10.10

Description A stack-based buffer overflow exists in the lossless JPEG Define Huffman Table parser within the decode jpegsof3() function. This occurs when a crafted lossless JPEG is processed where the DHT symbol counts wrap an 8-bit sum, leading to an overflow of the 32-entry HufVal and HufSz stack arrays, which results in a process crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.