imgproxy versions 4.0.0 up to but not including 4.0.16 have a critical integer overflow in the ICO loader. According to the advisory, a remote attacker could use a crafted ICO image to corrupt heap memory. This could crash the process and may allow code execution.
What Is It
CVE-2026-123614 is an integer overflow in imgproxy's ICO image loader. According to the advisory, an attacker supplies a crafted ICO image with a manipulated data_size value. That value can wrap the memory allocation in vips/icoload.c, so the allocated buffer is too small and a heap buffer overflow follows. The weakness is classified as CWE-122 (Heap-based Buffer Overflow).
VulnCheck ([email protected]) reported the issue. The NVD record currently has the status "Received."
Why It Matters
The flaw is rated CRITICAL:
- CVSS 3.1: 9.8 (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - CVSS 4.0: 9.3 (
AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H)
These vectors describe an attack over the network with low complexity, no privileges and no user interaction. A successful attack would have a high impact on confidentiality, integrity and availability.
imgproxy's job is to process the images it receives, so a malicious ICO file may only need to reach the service to trigger the bug. The advisory says the possible results range from a process crash (denial of service) to code execution. The supplied data does not show that code execution has been demonstrated.
Exploitation status: The supplied CISA KEV entry is empty, so KEV does not currently confirm active exploitation of this CVE. The NVD data also has no information on exploit maturity.
What's Vulnerable
- Vendor/Product: imgproxy / imgproxy
- Package:
pkg:golang/github.com/imgproxy/imgproxy/v4 - Affected: versions from 4.0.0 up to but not including 4.0.16 (semver)
- Unaffected: 4.0.16
The record lists no CPE entries.
Patch Status
Version 4.0.16 is listed as unaffected. Operators running imgproxy 4.0.0 through 4.0.15 should upgrade to 4.0.16 or later. No KEV entry exists for this CVE, so the supplied data has no CISA required action or due date. For full remediation details, see the vendor's GitHub security advisory (GHSA-hff9-5pqw-6w9f).