CVE-2026-120251 in imagecodecs
Summary
by MITRE • 11/01/2026
imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt_fax4_decode_size() that allows attackers to hang the calling process by supplying a crafted CCITT Group 4 stream. Attackers can provide an 8-byte G4 stream lacking EOFB to ccittfax4_decode() or the numcodecs Ccittfax4 codec, consuming full CPU until the process is killed.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/01/2026
The vulnerability identified in imagecodecs versions ranging from 2026.3.6 through 2026.10.10 represents a critical denial of service risk rooted in improper input validation within the CCITT Group 4 fax decoding logic. Specifically, the function ccitt_fax4_decode_size() fails to adequately verify the structural integrity and termination conditions of incoming data streams before initiating the decoding process. This flaw allows an attacker to craft malicious inputs that exploit the internal state machine of the decoder, leading to a condition where the application enters an infinite loop rather than terminating or returning an error code when encountering malformed data structures.
The technical mechanism behind this vulnerability centers on the handling of End Of Block (EOB) markers within CCITT Group 4 compressed streams. A valid G4 stream must contain specific termination codes, such as EOFB, to signal the end of a scan line or block. By providing an eight-byte G4 stream that deliberately omits these required EOB markers, an attacker forces the decoder into a state where it continuously attempts to process non-existent data boundaries. The decoding engine remains trapped in this loop because its internal logic expects specific bit patterns that are never present due to the truncated nature of the input, causing the CPU usage to spike to one hundred percent as the thread spins without yielding control or making progress toward completion.
From an operational perspective, this vulnerability poses a severe availability risk for any application utilizing imagecodecs for processing fax images or similar CCITT-compliant data formats. Since the flaw results in unbounded resource consumption, it can lead to complete system hangs if not mitigated by external process management tools. In web services or multi-threaded applications, such an event could exhaust available CPU resources, potentially causing a cascade failure that affects other legitimate users and processes sharing the same computational environment. The impact is particularly acute because the attack vector requires only minimal data input, making it easy to trigger via network requests or file uploads without requiring authentication in many default configurations.
This issue aligns with CWE-835, which describes loops that consume excessive resources due to missing termination conditions, and falls under the MITRE ATT&CK technique T1496, representing Resource Hijacking where an attacker consumes computational resources to degrade service availability. To mitigate this risk, developers should implement strict input validation checks before passing data to the decoding functions, ensuring that expected structural markers are present or implementing a timeout mechanism for long-running decode operations. Upgrading to patched versions of imagecodecs beyond 2026.10.10 is essential as these releases address the logic errors in ccitt_fax4_decode_size(). Additionally, deploying resource limits such as CPU quotas at the container or process level can provide a defensive layer against exploitation attempts by automatically terminating processes that exceed defined computational thresholds.