CVE-2026-107621

7.5High

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-835

Impact

Remote, unauthenticated attackers can cause a persistent denial of service by triggering an infinite loop via network traffic. They need only send a crafted or truncated JPEG stream to the processing service.

Root cause

JPEGParser fails to handle malformed or truncated input streams properly, entering an infinite loop with unreachable exit conditions.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Check CISA advisory icsma-26-288-02 for target firmware/software versions; isolate network access or block untrusted stream ingestion to the affected parser until updated.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-107621