imagecodecs vulnerabilities
CVEs whose affected-version data names the imagecodecs package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-120252Medium· 5.5imagecodecs 2023.1.23 through 2026.10.10 Stack Buffer Overflow via jpegsof3_decode()
imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG Define Huffman Table parser in decode_jpegsof3(). Attackers can supply a crafted lossless JPEG whose DHT symbol counts wra…
▾ Sunlitcgohlke · imagecodecsEPSS 0.14%via CVEORG
CVE-2026-120251Medium· 5.5PoCimagecodecs 2026.3.6 through 2026.10.10 Infinite Loop via ccittfax4_decode()
imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt_fax4_decode_size() that allows attackers to hang the calling process by supplying a crafted CCITT Group 4 stream. Attackers can provide an 8-byte G4…
▾ Twilightcgohlke · imagecodecsEPSS 0.12%via CVEORG