PT-2026-139897

CVE-2026-123616

Published

2026-10-30

Updated

2026-11-08

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions imgproxy versions 3.3.0 through 4.0.15

Description The ICO loader fails to validate the data size field, leading to unbounded memory allocation. An unauthenticated attacker can provide a specially crafted 23-byte ICO file that declares a data size of approximately 4GB, resulting in memory exhaustion and worker crashes.

Recommendations Update imgproxy to version 4.0.16 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-789: Memory Allocation with Excessive Size Value

CWE-400: Uncontrolled Resource Consumption

Related identifiers