CVE-2026-123615
HighCVSS 7.5Summary
imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction (vips_foreign_load_ico_header in vips/icoload.c) when an ICO entry declares a tiny data size, causing unvalidated header fields to be read and written past the allocated buffer. Unauthenticated remote attackers can supply a crafted ICO image to corrupt adjacent heap chunk metadata, triggering a glibc abort that crashes the worker.
Risk Assessment
Heap memory corruption can lead to service crashes and, under favorable conditions, code execution, threatening availability and confidentiality.
Recommendation
Update imgproxy to version 4.0.17 or later. Until patched, restrict ICO image intake from untrusted sources.
Other vulnerabilities in imgproxy
See all- CVE-2026-123616High
imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the data_size field. Attackers can supply a crafted 23-byte ICO file declaring a ~4GB data_size to trigger memory exhaustion and worker crashes without authentication.
- CVE-2026-123614Critical
imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vips/icoload.c, corrupting heap memory to crash the process or achieve code execution.
- CVE-2026-105708Medium
A flaw has been found in imgproxy up to 4.0.17 in the sanitizeElement function of processing/svg/svg.go in the SVG Handler component. Manipulation of input leads to cross site scripting, and the attack can be launched remotely. The exploit has been published and may be used; the project has not responded to the issue report.
Original NVD description (English source)
imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction (vips_foreign_load_ico_header in vips/icoload.c) when an ICO entry declares a tiny data size, causing unvalidated header fields to be read and written past the allocated buffer. Unauthenticated remote attackers can supply a crafted ICO image to corrupt adjacent heap chunk metadata, triggering a glibc abort that crashes the worker.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS