Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

imgproxy can be crashed or hijacked by crafted ICO file

CVE-2026-123614 · published today
Summary

Versions of imgproxy from 4.0.0 up to 4.0.15 may mishandle a specially crafted ICO image, causing memory corruption. This can make the service stop working or allow an attacker to run their own code. Update imgproxy to version 4.0.16 or later to fix the problem.

What to do
  • Update imgproxy imgproxy to version 4.0.16 or later.
Affected software
VendorProductAffected versions
imgproxy imgproxy < 4.0.16
Original advisory text
imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflow
imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vips/icoload.c, corrupting heap memory to crash the process or achieve code execution.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Type
CWE-122Heap-based Buffer Overflow
Timeline
Published8 Nov 2026
Updated8 Nov 2026
First seen8 Nov 2026
Sources
CVE-2026-123614 · NVD
CVE-2026-123614 · MITRE
Track software like this
Free during beta