EUVD-2026-114749
GHSA-89vm-wj4q-hr3r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious lossless JPEG with DHT counts wrapping 8-bit sum
-
DeliveryDeliver file to victim application
-
ExploitApplication decodes via imagecodecs decode_jpegsof3()
-
ExecutionOverflow 32-entry HufVal/HufSz stack arrays
-
ImpactCrash calling process (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that an application decode an attacker-supplied lossless JPEG (JPEG SOF3 / lossless path) through imagecodecs' decode_jpegsof3() function; the crafted file must contain a Define Huffman Table whose symbol counts sum wraps an 8-bit accumulator, so that writing exceeds the fixed 32-entry HufVal and HufSz stack arrays. Limiting factors that reduce real-world risk: the vector is local (AV:L) and needs passive interaction (UI:P) - the attacker cannot trigger it remotely by themselves but must get the malicious image to a victim or service that decodes it; only the lossless-JPEG decode code path is affected; and the assessed impact is confined to a process crash (availability), with no confidentiality or integrity effect per the description and CVSS vector. |
| Impact | This is a medium-severity denial-of-service issue, not a high-priority emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, score 6.8) tells a consistent story with the description: exploitation is local and requires passive user/application interaction (a victim must decode the attacker's file), and the only impact is availability (VA:H) - the description explicitly says the flaw 'crashes the calling process,' with no confidentiality or integrity impact (VC:N/VI:N). The vuln.today decision label is 'this_month,' not act_now or emergency, which aligns with a crash-only, interaction-dependent, local-vector bug. The flaw is classified CWE-121 (stack-based buffer overflow), a class that can sometimes enable code execution, but both the description and the CVSS impact metrics restrict the assessed consequence to a crash; whether exploitation beyond DoS is achievable is not established in the available sources and should not be assumed. Several key risk signals are MISSING from the input: there is no EPSS exploitation-probability score provided, and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation. A public GitHub bug report (issue #157) and a VulnCheck advisory exist, but the input does not confirm working public exploit code. Net: real but modest - prioritize patching in software that decodes untrusted lossless JPEGs via imagecodecs, without treating it as an actively-exploited critical. |
| Exploit ScenarioDerived | An application that uses imagecodecs to decode user-supplied images - for example a scientific-imaging pipeline, batch converter, or a service that accepts uploaded images - processes an attacker-crafted lossless JPEG (SOF3). The malformed Define Huffman Table, whose symbol counts wrap an 8-bit sum, overflows the fixed 32-entry HufVal/HufSz stack arrays in decode_jpegsof3() and crashes the process, causing denial of service. Exploitation is local and requires the victim to actually decode the file (UI:P); a public GitHub issue documents the bug, but the input does not confirm verified working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 01, 2026
Stack-based buffer overflow in imagecodecs (versions 2023.1.23 through 2026.10.10) is reachable through the lossless JPEG path, where decode_jpegsof3() parses a Define Huffman Table whose symbol counts wrap an 8-bit accumulator and overrun the fixed 32-entry HufVal and HufSz stack arrays. An attacker who can get a crafted JPEG SOF3 file decoded by the library - locally, with the victim or a service performing the decode - crashes the calling process; per the assessed CVSS:3.1 vector (AV:L/AC:L/PR:N/UI:R, C:N/I:N/A:H) impact is limited to availability, with no confidentiality or integrity effect. The issue is a medium-severity denial of service rather than a high-priority emergency: only the lossless-JPEG decode code path is affected, the attack is not remotely self-triggering, and no public exploit code has been identified at time of analysis.
RemediationAI
The available data does not list a fixed release version: no vendor-released patch version is identified at time of analysis, and the only upstream tracking reference is https://github.com/cgohlke/imagecodecs/issues/157 (with the vulnerable code at https://github.com/cgohlke/imagecodecs/blob/v2026.10.10/3rdparty/jpegsof3/jpegsof3.cpp#L394) - check that issue and the project page https://github.com/cgohlke/imagecodecs for the release that carries the DHT symbol-count validation fix, and upgrade imagecodecs to that version once published; note that the affected range runs through 2026.10.10, so versions up to and including that release should be treated as unfixed. Because the flaw is reachable only through the lossless JPEG (SOF3) decode path in decode_jpegsof3(), a compensating control until a patched build is in place is to avoid decoding untrusted lossless-JPEG input in imagecodecs - front-end gateways or ingestion pipelines should reject SOF3/JPEG-LS-less lossless JPEG files before they reach the library, or run the decode in a separate, resource-limited worker process so that an overflow terminates only that worker; the trade-off is that legitimate lossless JPEG processing is blocked or incurs process-isolation overhead. Per the VulnCheck advisory (https://www.vulncheck.com/advisories/imagecodecs-2023.1.23-through-2026.10.10-stack-buffer-overflow-via-jpegsof3-decode), exposure requires a crafted file to be decoded, so restricting which sources can supply images to imagecodecs-based services also reduces risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
imagecodecs is a Python wrapper around a set of bundled third-party image codecs, and the affected component is its bundled lossless JPEG implementation (jpegsof3), invoked from decode_jpegsof3(). Lossless JPEG uses SOF3 frames and, like baseline JPEG, carries Huffman tables in DHT markers. The parser reads the per-symbol count fields from a DHT segment and accumulates them into an 8-bit counter; because that sum can wrap, the code does not reject a table that in fact defines more than 32 symbols, and the subsequent writes exceed the fixed-size HufVal and HufSz stack arrays (32 entries each). This is CWE-121 (stack-based buffer overflow): the root cause is insufficient validation of attacker-controlled table metadata before writing into fixed-length stack storage, producing memory corruption that manifests as a process crash. The CPE cpe:2.3:a:cgohlke:imagecodecs identifies the cgohlke/imagecodecs project as the affected product; the referenced source line in the v2026.10.10 tree (3rdparty/jpegsof3/jpegsof3.cpp#L394) is the DHT parsing location. The trigger is exactly the wrapped symbol-count condition described above; no further exploitation mechanics are described in the available sources, and the assessed impact stops at denial of service.
Know when Imagecodecs gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
A victim application must decode an attacker-supplied file (AV:L, UI:R), no privileges needed (PR:N), and the only consequence is a process crash (C:N/I:N/A:H).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG Define Huffman Table parser in decode_jpegsof3(). Attackers can supply a crafted lossless JPEG whose DHT symbol counts wrap an 8-bit sum, overflowing the 32-entry HufVal and HufSz stack arrays and crashing the calling process.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB