CVE-2026-123614

Name of the Vulnerable Software and Affected Versions imgproxy versions 4.0.0 through 4.0.15

Description An integer overflow exists in the ICO loader, specifically within the vips/icoload.c file. A remote attacker can exploit this by submitting a crafted ICO image with a malicious data size value that wraps the memory allocation, leading to a heap buffer overflow. This memory corruption can result in a process crash or remote code execution.

Recommendations Update imgproxy to version 4.0.16.