CVE-2026-120251
Description
A flaw was found in imagecodecs. This vulnerability allows an attacker to cause a Denial of Service (DoS) by tricking a user or application into processing a specially crafted CCITT Group 4 fax image stream. An infinite loop in the fax decoding routine causes the process to consume excessive CPU resources and hang indefinitely until terminated.
Statement
imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop in ccitt_fax4_decode_size()/ccitt_decode_2d_line when decoding a crafted CCITT Group 4 fax stream lacking EOFB, causing excessive CPU consumption and a hang of the calling process. No fixed release exists yet.
Mitigation
Avoid decoding untrusted or fax-compressed (CCITT G4/T4) image streams with imagecodecs; constrain or kill decoding processes processing untrusted input until a fixed release is published.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Amplification
An infinite loop will cause unexpected consumption of resources, such as CPU cycles or memory. The software's operation may slow down, or cause a long time to respond.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
