CVE-2026-120252
Received Received - Intake

Stack-Based Buffer Overflow in imagecodecs JPEG Parser

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: VulnCheck

Description
imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG Define Huffman Table parser in decode_jpegsof3(). Attackers can supply a crafted lossless JPEG whose DHT symbol counts wrap an 8-bit sum, overflowing the 32-entry HufVal and HufSz stack arrays and crashing the calling process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-120252
EUVD
EUVD-2026-114749

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cgohlke imagecodecs 2023.1.23

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-120252 is a stack-based buffer overflow in the imagecodecs library affecting versions 2023.1.23 through 2026.10.10. The flaw occurs in the lossless JPEG Define Huffman Table parser within the decode_jpegsof3() function. Attackers can exploit this by providing a specially crafted lossless JPEG file where symbol counts wrap an 8-bit sum, causing an overflow in 32-entry stack arrays (HufVal and HufSz). This leads to a crash of the calling process.

Detection Guidance

To detect this vulnerability, inspect systems running imagecodecs versions between 2023.1.23 and 2026.10.10. Check installed versions with: pip show imagecodecs. Verify if any process crashes when processing lossless JPEG files, particularly those with crafted DHT segments. Use fuzz testing tools to generate malformed JPEG inputs targeting the jpegsof3_decode function.

  • Check installed version: pip show imagecodecs
  • Monitor for crashes in image processing applications using imagecodecs
  • Test with crafted JPEG files to trigger buffer overflow conditions
Impact Analysis

This vulnerability can cause denial-of-service by crashing applications using vulnerable versions of imagecodecs when processing malicious JPEG files. It may also lead to memory corruption or potential arbitrary code execution in some cases, depending on system configurations and protections.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks through crafted JPEG files, potentially disrupting processing of sensitive image data. Stack-based buffer overflows may lead to memory corruption, affecting integrity and availability of systems handling personal or health data.

Mitigation Strategies

Immediately upgrade imagecodecs to version v2026.10.10 or later, which contains fixes for the stack buffer overflow. If upgrading is not possible, disable processing of lossless JPEG files or restrict imagecodecs usage to trusted inputs only. Monitor security advisories for additional patches.

  • Upgrade imagecodecs: pip install --upgrade imagecodecs>=2026.10.10
  • Disable lossless JPEG processing in affected applications
  • Restrict imagecodecs usage to trusted image sources

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120252. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart