The imagecodecs library from versions 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow in the lossless JPEG Define Huffman Table parser within the decode_jpegsof3() function. When an attacker supplies a crafted lossless JPEG image whose DHT symbol counts wrap an 8‑bit sum, the 32-entry HufVal and HufSz arrays overflow, corrupting local stack memory and provoking a crash of the process that called the parser. The CVE description does not indicate code execution; the impact is limited to denial of service.

Any environment that imports the cgohlke:imagecodecs Python package in the affected version range, from 2023.1.23 to 2026.10.10, and uses the jpegsof3_decode() function to process lossless JPEG files, is at risk. The vulnerability is independent of the operating system or Python interpreter version.

The CVSS score of 6.8 classifies the defect as medium severity. Because an EPSS score is not provided and the issue is not listed in the CISA KEV catalog, the probability of widespread exploitation remains uncertain. The likely attack vector is the delivery of a malicious lossless JPEG image to any running application that decodes such files, either locally or via a remote file upload, which will result in the application crashing. No evidence from the CVE details suggests advanced exploitation possibilities.