CVE-2026-123616: Security vulnerability
imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the datasize field. Attackers can supply a crafted 23-byte ICO file declaring a ~4GB datasize to trigger memory exhaustion and worker crashes without authentication.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments running imgproxy versions from 3.3.0 up to, but not including, 4.0.16 are affected when they process attacker-supplied ICO files. An attacker does not need authentication.
What does an attacker need to do to trigger the vulnerability?
The attacker needs to supply a crafted 23-byte ICO file whose data_size field declares roughly 4 GB. Processing that file can cause unbounded memory allocation, exhausting memory and crashing workers.
How can I determine whether my deployment is affected?
Check the deployed imgproxy version and whether it falls between 3.3.0 and versions before 4.0.16. Also determine whether the service can be made to process untrusted ICO input; the vulnerable code is the ICO loader.