Threats affecting pkg:pypi/imagecodecs

A stack-based buffer overflow vulnerability exists in the imagecodecs library versions 2023.1.23 through 2026.10.10. The flaw occurs in the lossless JPEG Define Huffman Table parser function decode_jpegsof3(), where crafted lossless JPEG files with manipulated DHT symbol counts can overflow internal stack arrays, causing a crash.

imagecodecs versions 2026.3.6 through 2026.10.10 contain an infinite loop vulnerability in the ccitt_fax4_decode_size() function. This flaw allows an attacker to hang the calling process by providing a crafted CCITT Group 4 stream that lacks an End Of Facsimile Block (EOFB). The vulnerability results in full CPU consumption until the affected process is terminated.