CVE-2026-123616highCWE-789

CVE-2026-123616: high-severity vulnerability in imgproxy

imgproxy 3.3.0 before 4.0.16 Memory Exhaustion DoS via ICO Loader

Published

Follow this CVE+ Monitor imgproxy

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

18Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7
imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the data_size field. Attackers can supply a crafted 23-byte ICO file declaring a ~4GB data_size to trigger memory exhaustion and worker crashes without authentication.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
imgproxy · imgproxy
Related CVEs — imgproxy

In the same product, most dangerous first.

CVE-2025-24354MEDIUMimgproxy is vulnerable to SSRF against 0.0.0.0EPSS 0.9%CVE-2026-123615HIGHimgproxy before 4.0.17 Out-of-Bounds Write in ICO LoaderEPSS —CVE-2026-123614CRITICALimgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer OverflowEPSS —