CVE-2026-120252

The record

imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG Define Huffman Table parser in decode_jpegsof3(). Attackers can supply a crafted lossless JPEG whose DHT symbol counts wrap an 8-bit sum, overflowing the 32-entry HufVal and HufSz stack arrays and crashing the calling process.

Affected packages

Related vulnerabilities

• CVE-2026-121249 Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-121
• CVE-2026-120752 PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in… CWE-121
• CVE-2026-29508 ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer… CWE-121
• CVE-2026-58966 In multiple functions of hppsfilter.c, there is a possible out-of-bounds write due to a… CWE-121
• CVE-2026-120067 For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for… CWE-121
• CVE-2026-120061 The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument… CWE-121
• CVE-2026-120063 When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length… CWE-121
• CVE-2026-106808 OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in… CWE-121