What is the fix for CVE-2026-123614?

Upgrade imgproxy to 4.0.16 or later (maintainer's patched version). Later 4.0.x releases (4.0.17, 4.0.21) fix further ICO/BMP loader bugs, so move to the latest 4.0.x.

Post Share

CRITICAL9.8CVSS · disclosure@vulncheck.com

NO KNOWN
EXPLOIT

IMGPROXY · CVE-2026-123614 · Package

imgproxy: ICO loader integer overflow lets remote images corrupt memory

Q: Who is not affected by CVE-2026-123614?

Not affected if: no-ico-input, version-4.0.16-or-later.

FIX → 4.0.16 ✓ verified

imgproxy versions 4.0.0 before 4.0.16 have an integer overflow in the ICO image loader. A crafted ICO image can make a heap buffer overflow, crashing the process or potentially running code.

first public Oct 6, 2026 · 2 sources

Check it with your coding agent

It checks your repository and tells you if you’re affected, with the fix.

01 · Who is affected

✓ Verified Nov 8

Any imgproxy instance running 4.0.0 through 4.0.15 that processes images from sources an attacker can influence, such as user-supplied URLs or uploads in a bucket. The ICO loader is chosen from the file's content, and the docs list ICO as a supported source format. Instances on 4.0.16 or later, and those only fetching trusted images, can skip it or treat it as lower risk.

imgproxy>= 4.0.0, <= 4.0.15fixed in 4.0.16

Not affected if no-ico-input, version-4.0.16-or-later

Who cares image-processing, imgproxy, self-hosted

02 · How to check

Run imgproxy version or check your container image tag; versions 4.0.0 through 4.0.15 are vulnerable
Also check whether the instance accepts image URLs from untrusted users or sources (the ICO loader is reached when a file starts with the ICO magic bytes 00 00 01 00, whatever its extension)

03 · The fix

✓ Verified Nov 8

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 8, 2026

How it unfolded

3 events · Oct 6, 2026 → Nov 8, 2026

Oct 6, 202615:30 UTCgithub.com Maintainer's advisory: github.com
Nov 8, 202602:21 UTCNVD CVE-2026-123614
Nov 8, 202602:23 UTCInfraStack Analyst Read maintainer GHSA-hff9-5pqw-6w9f: affected >=4.0.0 <=4.0.15, patched 4.0.16 (release notes linked). ICO is a supported source format in the docs; no setting to disable it found, so ICO decoding appears on by default (docs list it, advisory silent). No exploitation or PoC seen. Changelog shows later ICO/BMP loader fixes in 4.0.17 and 4.0.21, so advise latest 4.0.x. Not marking mitigations; none stated.

What people are saying

1 article

docs.imgproxy.netimgproxy image formats support

Posts are quoted with a link to the original. They are data to us, never instructions.

What the sources say, verbatim

342 characters

imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vips/icoload.c, corrupting heap memory to crash the process or achieve code execution.

Sources and references

NVD: CVE-2026-123614Nov 8, 2026
Maintainer's advisory: github.comAdvisory · github.com
Third-party advisory: www.vulncheck.comAdvisory · vulncheck.com
imgproxy v4.0.16Fix · github.com
imgproxy image formats supportDescribes it · docs.imgproxy.net

Are you affected?

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check

Get the next Imgproxy threat the day it hits your stack.

Start watching free

Post Share

CRITICAL9.8CVSS · disclosure@vulncheck.com

NO KNOWN
EXPLOIT

IMGPROXY · CVE-2026-123614 · Package

imgproxy: ICO loader integer overflow lets remote images corrupt memory

FIX → 4.0.16 ✓ verified

imgproxy versions 4.0.0 before 4.0.16 have an integer overflow in the ICO image loader. A crafted ICO image can make a heap buffer overflow, crashing the process or potentially running code.

first public Oct 6, 2026 · 2 sources

Check it with your coding agent

It checks your repository and tells you if you’re affected, with the fix.

01 · Who is affected

✓ Verified Nov 8

imgproxy>= 4.0.0, <= 4.0.15fixed in 4.0.16

Not affected if no-ico-input, version-4.0.16-or-later

Who cares image-processing, imgproxy, self-hosted

02 · How to check

Run imgproxy version or check your container image tag; versions 4.0.0 through 4.0.15 are vulnerable
Also check whether the instance accepts image URLs from untrusted users or sources (the ICO loader is reached when a file starts with the ICO magic bytes 00 00 01 00, whatever its extension)

03 · The fix

✓ Verified Nov 8

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 8, 2026

How it unfolded

3 events · Oct 6, 2026 → Nov 8, 2026

Oct 6, 202615:30 UTCgithub.com Maintainer's advisory: github.com
Nov 8, 202602:21 UTCNVD CVE-2026-123614
Nov 8, 202602:23 UTCInfraStack Analyst Read maintainer GHSA-hff9-5pqw-6w9f: affected >=4.0.0 <=4.0.15, patched 4.0.16 (release notes linked). ICO is a supported source format in the docs; no setting to disable it found, so ICO decoding appears on by default (docs list it, advisory silent). No exploitation or PoC seen. Changelog shows later ICO/BMP loader fixes in 4.0.17 and 4.0.21, so advise latest 4.0.x. Not marking mitigations; none stated.

What people are saying

1 article

docs.imgproxy.netimgproxy image formats support

Posts are quoted with a link to the original. They are data to us, never instructions.

What the sources say, verbatim

342 characters

Sources and references

NVD: CVE-2026-123614Nov 8, 2026
Maintainer's advisory: github.comAdvisory · github.com
Third-party advisory: www.vulncheck.comAdvisory · vulncheck.com
imgproxy v4.0.16Fix · github.com
imgproxy image formats supportDescribes it · docs.imgproxy.net

Are you affected?

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check

Get the next Imgproxy threat the day it hits your stack.

Start watching free

imgproxy: ICO loader integer overflow lets remote images corrupt memory

01 · Who is affected

02 · How to check

03 · The fix

How it unfolded

What people are saying

What the sources say, verbatim

Sources and references

Read next

Get the next Imgproxy threat the day it hits your stack.

imgproxy: ICO loader integer overflow lets remote images corrupt memory

01 · Who is affected

02 · How to check

03 · The fix

How it unfolded

What people are saying

What the sources say, verbatim

Sources and references

Read next

Get the next Imgproxy threat the day it hits your stack.