Medium severity5.5NVD Advisory· Published Nov 1, 2026

CVE-2026-120251

Description

imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt_fax4_decode_size() that allows attackers to hang the calling process by supplying a crafted CCITT Group 4 stream. Attackers can provide an 8-byte G4 stream lacking EOFB to ccittfax4_decode() or the numcodecs Ccittfax4 codec, consuming full CPU until the process is killed.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cgohlke/imagecodecsllm-create
Range: 2026.3.6 - 2026.10.10

Patches

Vulnerability mechanics

References

github.com/cgohlke/imagecodecs/blob/v2026.10.10/3rdparty/ccitt/ccitt.cnvd
github.com/cgohlke/imagecodecs/issues/158nvd
www.vulncheck.com/advisories/imagecodecs-2026.3.6-through-2026.10.10-infinite-loop-via-ccittfax4-decodenvd

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000