Stack-Based Buffer Overflow in imagecodecs Product by CGohlke

CVE-2026-120252

What is CVE-2026-120252?

The imagecodecs product versions from 2023.1.23 to 2026.10.10 are susceptible to a stack-based buffer overflow vulnerability. This issue arises through a flaw in the lossless JPEG Define Huffman Table parser, specifically in the decode_jpegsof3() function. Attackers can exploit this vulnerability by supplying a specially crafted lossless JPEG image, which may lead to an overflow condition when the DHT symbol counts exceed an 8-bit sum. This ultimately leads to the crashing of the affected process, potentially allowing for unauthorized access or service disruption.

References