imagecodecs CVE-2026-120251

Exploitation requires that the target application feed attacker-controlled data to imagecodecs' ccittfax4_decode() function or the numcodecs Ccittfax4 codec, and that the attacker can supply a crafted CCITT Group 4 stream - specifically an 8-byte G4 stream lacking the EOFB (end-of-facsimile-block) marker. The limiting factors: the CVSS vector indicates a local attack vector (AV:L) and passive user interaction (UI:P), meaning a victim/process must actually invoke the vulnerable decode path on the malicious input, so the flaw is only reachable in deployments that decode untrusted CCITT G4 data. Affected versions are imagecodecs 2026.3.6 through 2026.10.10; deployments outside this range or not using the CCITT G4 decode path are not exposed. Impact is confined to availability (process hang/CPU exhaustion); there is no path to data disclosure or code execution.

This is a moderate, availability-only issue rather than a top-tier emergency. The supplied CVSS 4.0 vector (6.8) is AV:L/AC:L/AT:N/PR:N/UI:P with impact confined to VA:H and VC/VI = N, meaning the only consequence is a hung process (CPU exhaustion), not code execution or data compromise. The vuln.today decision label is 'this_month' (not act_now/emergency), which is consistent with a denial-of-service bug in a specialized library. No EPSS score was provided in the input, so exploitation probability cannot be quantified; this is a missing signal, not a zero. The issue is NOT in CISA KEV and the input does not flag a confirmed working exploit, so there is no evidence of active exploitation. Note one tension to verify: the CVSS vector is AV:L (local), yet the real-world trigger is attacker-supplied decoded data - if a deployment passes untrusted remote input (e.g., an uploaded image/stream) to ccittfax4_decode(), the practical reachability can resemble a network-adjacent DoS even though the base vector is local; confirm how attacker data reaches the decoder in your environment. Overall: a real but bounded DoS priority, appropriately rated medium, warranting scheduled patching rather than crisis response.

An attacker crafts a malformed 8-byte CCITT Group 4 stream that lacks the EOFB marker and gets a victim application - one that decodes untrusted CCITT G4 data via imagecodecs' ccittfax4_decode() or the numcodecs Ccittfax4 codec - to process it. The decoder enters an infinite loop in ccitt_fax4_decode_size(), pinning a CPU core at 100% and hanging the calling process until it is externally killed. No confirmed public exploit is listed in the input, though the advisory and the GitHub issue document the exact minimal trigger.