CVE-2026-123615highCWE-787

CVE-2026-123615: high-severity vulnerability in imgproxy

imgproxy before 4.0.17 Out-of-Bounds Write in ICO Loader

Published

Follow this CVE+ Monitor imgproxy

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

18Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7
imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction (vips_foreign_load_ico_header in vips/icoload.c) when an ICO entry declares a tiny data size, causing unvalidated header fields to be read and written past the allocated buffer. Unauthenticated remote attackers can supply a crafted ICO image to corrupt adjacent heap chunk metadata, triggering a glibc abort that crashes the worker.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
imgproxy · imgproxy
Related CVEs — imgproxy

In the same product, most dangerous first.

CVE-2025-24354MEDIUMimgproxy is vulnerable to SSRF against 0.0.0.0EPSS 0.9%CVE-2026-123616HIGHimgproxy 3.3.0 before 4.0.16 Memory Exhaustion DoS via ICO LoaderEPSS —CVE-2026-123614CRITICALimgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer OverflowEPSS —