CVE-2026-120251

The record

imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt_fax4_decode_size() that allows attackers to hang the calling process by supplying a crafted CCITT Group 4 stream. Attackers can provide an 8-byte G4 stream lacking EOFB to ccittfax4_decode() or the numcodecs Ccittfax4 codec, consuming full CPU until the process is killed.

Affected packages

Related vulnerabilities

• CVE-2026-63475 isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. CWE-835
• CVE-2026-121261 A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. CWE-835
• CVE-2026-121400 FreeRDP before 3.32.2 contains a denial-of-service vulnerability in… CWE-835
• CVE-2026-119738 The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService)… CWE-835
• CVE-2026-120596 A remotely exploitable denial-of-service vulnerability exists in the TCP options parser… CWE-835
• CVE-2026-120458 Kvazaar through 2.3.2 contains an infinite loop vulnerability in read_header() in… CWE-835
• CVE-2026-120194 A flaw was found in json-glib. CWE-835
• CVE-2026-62250 LibreDWG is a free C library to read and write DWG files. CWE-835