CVE-2026-120252
Description
A flaw was found in imagecodecs. A stack-based buffer overflow exists in the lossless JPEG parser within the decode_jpegsof3() function due to improper validation of Huffman table symbol counts. By enticing a user or application to process a specially crafted lossless JPEG image file, an attacker could trigger stack memory corruption, causing the application to crash and resulting in a Denial of Service (DoS).
Statement
A stack-based buffer overflow was found in imagecodecs' lossless JPEG (SOF3) Huffman table parser, decode_jpegsof3(). Crafted DHT symbol counts wrap an 8-bit sum, bypassing the >17 guard and overflowing the 32-entry HufVal/HufSz stack arrays, crashing the process. This affects imagecodecs versions 2023.1.23 through 2026.10.10 when decoding attacker-supplied lossless JPEG data and results in denial of service only; no fixed release is available yet.
Mitigation
Avoid decoding untrusted or unvalidated lossless JPEG (SOF3) images with imagecodecs.jpegsof3_decode until a fixed release is available; restrict input sources or validate JPEG SOF3 DHT symbol counts before decoding.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
