CVE-2026-123614criticalCWE-122

CVE-2026-123614: critical vulnerability in imgproxy

imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflow

Published

Follow this CVE+ Monitor imgproxy

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3
imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vips/icoload.c, corrupting heap memory to crash the process or achieve code execution.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
imgproxy · imgproxy
Related CVEs — imgproxy

In the same product, most dangerous first.

CVE-2025-24354MEDIUMimgproxy is vulnerable to SSRF against 0.0.0.0EPSS 0.9%CVE-2026-123616HIGHimgproxy 3.3.0 before 4.0.16 Memory Exhaustion DoS via ICO LoaderEPSS —CVE-2026-123615HIGHimgproxy before 4.0.17 Out-of-Bounds Write in ICO LoaderEPSS —