imagecodecs Decoder Memory Safety Flaws

Crafted CCITT Group 4 image data can hang processes that use imagecodecs 2026.3.6 through 2026.10.10: a stream missing the end-of-facsimile-block marker drives ccitt_fax4_decode_size() into an infinite loop, consuming full CPU until the process is terminated. The flaw is availability-only, with no confidentiality or integrity impact, and the supplied vector and independent assessment require a local decode path plus user interaction, so only deployments that decode untrusted G4 data are exposed. No public exploit was identified at time of analysis.

Stack-based buffer overflow in imagecodecs (versions 2023.1.23 through 2026.10.10) is reachable through the lossless JPEG path, where decode_jpegsof3() parses a Define Huffman Table whose symbol counts wrap an 8-bit accumulator and overrun the fixed 32-entry HufVal and HufSz stack arrays. An attacker who can get a crafted JPEG SOF3 file decoded by the library - locally, with the victim or a service performing the decode - crashes the calling process; per the assessed CVSS:3.1 vector (AV:L/AC:L/PR:N/UI:R, C:N/I:N/A:H) impact is limited to availability, with no confidentiality or integrity effect. The issue is a medium-severity denial of service rather than a high-priority emergency: only the lossless-JPEG decode code path is affected, the attack is not remotely self-triggering, and no public exploit code has been identified at time of analysis.