CVE-2026-123614
imgproxy
Published 8 Nov 2026 · updated 8 Nov 2026 · Received
9.3 Critical · CVSS 4.0, vulncheck.com
Description
imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vips/icoload.c, corrupting heap memory to crash the process or achieve code execution.