The vulnerability in imagecodecs allows an attacker to cause an infinite loop in the ccittfax4_decode() routine by sending a specially crafted CCITT Group 4 stream missing the end-of-file marker. This loop consumes CPU indefinitely and will eventually terminate the affected process, resulting in a denial of service condition. The weakness corresponds to CWE-835. The impact is limited to the process that performs the decode and does not leak data or provide remote code execution.

The affected product is the imagecodecs package released by cgohlke, with vulnerable versions from 2026.3.6 through 2026.10.10. Any system that imports or uses this package may be impacted.

The CVSS score of 6.8 indicates moderate severity. EPSS is not available, so the precise likelihood of exploitation is unclear, and the vulnerability is not listed in the CISA KEV catalog. Attackers can supply a malicious input to ccittfax4_decode() or the Ccittfax4 codec, triggering the infinite loop; no special permissions or elevated privileges are required beyond the process’s normal runtime.