pypi imagecodecs vulnerabilities

Latest pypi imagecodecs CVEs

Newest publication first

1. CVE-2026-120252 imagecodecs 2023.1.23 through 2026.10.10 Stack Buffer Overflow via jpegsof3_decode()

   Published 2026-11-01

   Medium·CVSS 6.8 EPSS 0.14%

   imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG Define Huffman Table parser in decode_jpegsof3(). Attackers can supply a crafted lossless JPEG whose DHT symbol counts wrap an 8-bit sum, overflowing the 32-entry Hu...

2. CVE-2026-120251 imagecodecs 2026.3.6 through 2026.10.10 Infinite Loop via ccittfax4_decode()

   Published 2026-11-01

   Medium·CVSS 6.8 EPSS 0.12%

   imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt_fax4_decode_size() that allows attackers to hang the calling process by supplying a crafted CCITT Group 4 stream. Attackers can provide an 8-byte G4 stream lacking EOFB to ccittfax4_decode()...

3. GHSA-94vc-p8w7-5p49 Bundled libwebp in imagecodecs vulnerable

   Published 2023-10-05

   Unknown

   imagecodecs versions before v2023.9.18 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). imagecodecs v2023.9.18 upgrades the bundled libwebp binary to v1.3.2.

4. PYSEC-2023-174 imagecodecs versions before v2023.9.18 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). imagecodecs v2023.9.18 upgrades the bundled libwebp binary to...

   Published 2023-09-20

   Unknown

   imagecodecs versions before v2023.9.18 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). imagecodecs v2023.9.18 upgrades the bundled libwebp binary to v1.3.2.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.