CVE-2026-120252
imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG Define Huffman Table pars
CVSS
5.5
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 1, 2026 · Last modified: Nov 1, 2026 · CWE-121
Not enough EPSS history yet.
imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG Define Huffman Table parser in decode_jpegsof3(). Attackers can supply a crafted lossless JPEG whose DHT symbol counts wrap an 8-bit sum, overflowing the 32-entry HufVal and HufSz stack arrays and crashing the calling process.
- github.comhttps://github.com/cgohlke/imagecodecs
- github.comhttps://github.com/cgohlke/imagecodecs/blob/v2026.10.10/3rdparty/jpegsof3/jpegsof3.cpp#L394
- github.comhttps://github.com/cgohlke/imagecodecs/issues/157
- www.vulncheck.comhttps://www.vulncheck.com/advisories/imagecodecs-2023.1.23-through-2026.10.10-stack-buffer-overflow-via-jpegsof3-decode
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-12018910.0 CRI—
———A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.7hCVE-2026-784039.8 CRI—
——0Stack-based buffer overflow and missing
authorization vulnerability in Thales Sentinel Keys Server on Windows allows
Overflow Buffers. Sentinel Keys Server does not check the length of the first
field in the HTTP request. An attacker may craft an HTTP request and send it to
Sentinel Keys Server. It may lead to remote code execution as NT
AUTHORITY\SYSTEM.
This issue affects Sentinel Keys Server:
versions lower than 1.3.8.0.2dCVE-2026-784027.8 HIG—
——0Stack-based buffer overflow and out-of-bounds
write vulnerability in Thales Sentinel Keys Server on Windows allows Overflow
Buffers.
Sentinel Keys Server does not check the length of the first field in
the input message. A local attacker may craft an input and send it to Sentinel
Keys Server. It may lead to code execution as NT AUTHORITY\SYSTEM enabling
local privilege escalation.
This issue affects Sentinel Keys Server: versions
lower than 1.3.8.0.2dCVE-2026-1190866.5 MED—
——0Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue sets enabled allows a local unprivileged task to write actor-controlled data beyond a pointer-sized object on the privileged kernel stack, affecting privileged memory across the MPU isolation boundary.
To remediate this issue, users should upgrade to FreeRTOS-Kernel V11.3.3, rebuild, and reflash affected firmware. Builds that do not enable queue sets are not affected.2dCVE-2026-1195287.8 HIG—
——0A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.1dCVE-2026-65584—7.0%
——2Software installed and run as a non-privileged user may conduct improper GPU system calls causing a stack overflow in the kernel. The overflow occurs when processing resolved Linux/Android fence synchronization checkpoints, while user checkpoints are excluded from the stack array. Successful exploitation can cause kernel memory corruption and typically results in a denial-of-service condition through a kernel crash.
The code vulnerability is a buffer write beyond the allocated array on the stack caused by copying excessive data from an internal buffer.2d