CVE-2026-123614: Buffer Overflow

Published Nov 8, 2026

Updated

imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted datasize value. Attackers can submit a crafted ICO image whose datasize wraps the allocation in vips/icoload.c, corrupting heap memory to crash the process or achieve code execution.

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using imgproxy versions 4.0.0 through versions before 4.0.16 are affected when they process attacker-controlled ICO images.

What does an attacker need to exploit this issue?

An attacker needs to submit a crafted ICO image containing a data_size value that causes an integer overflow during allocation in the ICO loader. The resulting heap buffer overflow can crash the process or potentially allow code execution.

How can I determine whether my deployment is affected?

Check the deployed imgproxy version and whether it can be made to process untrusted ICO files. Versions before 4.0.16 in the 4.0.x range described by the advisory are affected.

CVE-2026-123614: Buffer Overflow

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

How can I determine whether my deployment is affected?