CVE-2026-120251 cgohlke CVE debrief

Who should care

Defenders responsible for maintaining and securing systems that use the imagecodecs library should assess their exposure and take steps to verify and mitigate the vulnerability. This includes verifying the library version, applying patches or updates, and implementing input validation and sanitization to prevent crafted CCITT Group 4 streams from being processed. Additionally, defenders should monitor system resources and process activity to detect潜在 den

Why it matters

CVE-2026-120251 is a medium-severity vulnerability in the imagecodecs library that can cause an infinite loop, leading to denial-of-service attacks. Defenders should verify their systems, apply patches, and implement input validation to prevent exploitation.

• Denial-of-service attacks through excessive CPU consumption
• Potential for system crashes or freezes
• Increased risk of exploitation through crafted input
• Need for verification and patching of vulnerable systems

Technical summary

The imagecodecs library is vulnerable to an infinite loop attack when processing crafted CCITT Group 4 streams. This can be exploited by providing an 8-byte G4 stream lacking EOFB to ccittfax4_decode() or the numcodecs Ccittfax4 codec, causing the process to consume full CPU until it is killed. The vulnerability affects the ccitt_fax4_decode_size() function and can lead to denial-of-service attacks. Defenders should verify their systems, apply patches, and implement input validation to prevent exploitation. The vulnerability has a medium severity and is publicly disclosed.

Defensive priority

Defenders should prioritize verifying the vulnerability in their systems and applying patches or mitigations to prevent potential denial-of-service attacks.

Recommended defensive actions

• Verify the imagecodecs library version and check if it is within the vulnerable range.
• Apply patches or updates to the imagecodecs library to fix the vulnerability.
• Implement input validation and sanitization to prevent crafted CCITT Group 4 streams from being processed.
• Monitor system resources and process activity to detect potential denial-of-service attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was reported by Vulncheck and is publicly disclosed on GitHub and Vulncheck's website. The evidence provided includes limited source detail, which suggests that defenders should verify the vulnerability in their systems and apply patches or mitigations to prevent potential denial-of-service attacks. The vulnerability affects the imagecodecs library, specifically in the ccitt_fax4_decode_size() function, and can be exploited by providing an 8-byte G4 stream lacking EOFB to ccittfax4_decode() or the numcodecs Ccittfax4

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.