CVE-2026-123614

Summary

imgproxy versions 4.0.0 through 4.0.15 contain an integer overflow in the ICO image loader (vips/icoload.c) that leads to a heap buffer overflow when processing a specially crafted ICO file with a wrapped data_size value. This allows unauthenticated remote attackers to crash the service or potentially achieve remote code execution.

Exploitability

Exploitation requires submitting a maliciously crafted ICO image to imgproxy, but no authentication or user interaction is needed, making it trivial for remote attackers to attempt exploitation over the network.

Blast radius

Successful exploitation could lead to full system compromise of the imgproxy server, enabling data exfiltration, service disruption, or use as a pivot point within the infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to imgproxy version 4.0.16 or later, which contains the fix for the integer overflow in the ICO loader.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.