CVE-2026-120252 in imagecodecs
Summary
by MITRE • 11/01/2026
imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG Define Huffman Table parser in decode_jpegsof3(). Attackers can supply a crafted lossless JPEG whose DHT symbol counts wrap an 8-bit sum, overflowing the 32-entry HufVal and HufSz stack arrays and crashing the calling process.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/01/2026
The imagecodecs library, specifically versions ranging from 2023.1.23 through 2026.10.10, contains a critical memory safety vulnerability within its lossless JPEG parsing logic. This flaw is located in the decode_jpegsof3 function and affects the handler for Define Huffman Table segments. The core technical issue stems from an improper validation of input data during the parsing process. When processing a crafted lossless JPEG file, the parser fails to correctly account for potential integer wraparound conditions when calculating symbol counts. Specifically, the code sums up DHT symbol counts using an 8-bit arithmetic operation without adequate bounds checking or overflow detection mechanisms. This oversight allows an attacker to construct a malicious input where the sum of these counts wraps around due to exceeding the maximum value representable by eight bits.
This integer wraparound directly leads to a stack-based buffer overflow vulnerability, classified under CWE-120: Buffer Copy without Checking Size of Input. The miscalculated size results in an incorrect allocation or iteration limit for internal data structures. Consequently, when the parser proceeds to populate the HufVal and HufSz arrays, which are fixed at thirty-two entries each on the stack, it writes beyond their allocated boundaries. These arrays store Huffman value mappings and symbol sizes respectively, essential components for decoding JPEG images. The overflow corrupts adjacent memory locations on the call stack, potentially overwriting return addresses or other critical control data structures maintained by the application executing imagecodecs.
The operational impact of this vulnerability is severe, primarily manifesting as a denial of service through process termination. When the buffer overflow occurs, it typically triggers an immediate crash in the calling process due to memory protection mechanisms such as stack canaries or guard pages detecting the corruption. While modern exploitation techniques might attempt to leverage such overflows for arbitrary code execution by carefully crafting the overwritten data to hijack control flow, the primary and most certain outcome is application instability. For services that rely on imagecodecs for processing user-uploaded images, this vulnerability allows remote attackers to cause service disruptions simply by submitting a specially crafted lossless JPEG file. This can lead to significant downtime and resource exhaustion if automated systems repeatedly attempt to process malicious payloads without proper sandboxing or isolation.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1496: Resource Hijacking, as the immediate effect is consuming system resources through crashes. It also relates to CWE-20: Improper Input Validation, highlighting the failure of the software to adequately sanitize or validate numerical inputs before using them in memory allocation or array indexing operations. The lack of robust integer overflow checks represents a common class of defects often found in low-level image processing libraries where performance optimization sometimes comes at the expense of rigorous security validation.
Mitigation strategies should focus on immediate patching and defensive coding practices. Users must upgrade to a version of imagecodecs that is not affected by this vulnerability, ensuring that the maintainers have implemented proper integer overflow checks before performing arithmetic operations on input-derived values. Developers integrating this library into their applications should also implement strict file validation layers upstream of the parser. This includes verifying JPEG headers and segment lengths against expected constraints before passing data to imagecodecs functions. Additionally, deploying runtime application self-protection mechanisms or using compilers with stack protection features enabled can help mitigate the impact by detecting such overflows early and terminating execution safely rather than allowing potential exploitation for code injection. Regular security audits of third-party dependencies are essential to identify similar weaknesses in other parsing routines within the library ecosystem.