CVE-2026-123614 imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflow
CriticalCVSS 9.3
- Published
- Updated
- Exploit status
- No public exploit known
Description
imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vips/icoload.c, corrupting heap memory to crash the process or achieve code execution.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| imgproxy github.com/imgproxy/imgproxy/v3 | >= 4.0.0, < 4.0.16 | 4.0.16 |
| imgproxy github.com/imgproxy/imgproxy/v3(Go) | >= 4.0.0, < 4.0.16 | 4.0.16 |
| imgproxy github.com/imgproxy/imgproxy/v3(Go) | All versions | No fix listed |
References
- GitHub Security Advisory (GHSA-hff9-5pqw-6w9f) vendor-advisory
- VulnCheck Advisory: imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflow third-party-advisory
- github.com patch
- github.com product
- github.com