CVE-2026-123615

Name of the Vulnerable Software and Affected Versions imgproxy versions 3.3.0 through 4.0.16

Description An out-of-bounds heap read and write exists in the ICO loader's BMP header reconstruction within the vips foreign load ico header() function (located in vips/icoload.c). This occurs when an ICO entry declares a tiny data size, leading to unvalidated header fields being read and written beyond the allocated buffer. Unauthenticated remote attackers can exploit this by providing a specially crafted ICO image to corrupt adjacent heap chunk metadata, which triggers a glibc abort and crashes the worker process.

Recommendations Update imgproxy to version 4.0.17 or later.