---
id: "CVE-2026-123614"
page: "https://infrastack.ai/live/CVE-2026-123614"
kind: "vulnerability"
aliases: ["CVE-2026-123614"]
title: "imgproxy: ICO loader integer overflow lets remote images corrupt memory"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "imgproxy", "fixed": ["4.0.16"], "affected": ">= 4.0.0, <= 4.0.15", "ecosystem": "vendor"}]
ecosystems: []
tags: ["image-processing", "imgproxy", "package", "self-hosted"]
not_affected_if: ["no-ico-input", "version-4.0.16-or-later"]
published_at: "2026-11-08T02:16:56+00:00"
first_seen_at: "2026-11-08T02:21:14+00:00"
updated_at: "2026-11-08T02:23:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123614", "first_seen_at": "2026-11-08T02:21:14+00:00"}, {"source": "analyst", "url": "https://docs.imgproxy.net/image_formats_support", "first_seen_at": "2026-11-08T02:23:45+00:00", "cites": ["https://docs.imgproxy.net/image_formats_support"]}]
exploit_sources: []
---

# imgproxy: ICO loader integer overflow lets remote images corrupt memory

Link for people: https://infrastack.ai/live/CVE-2026-123614 (this .md is for agents)

imgproxy versions 4.0.0 before 4.0.16 have an integer overflow in the ICO image loader. A crafted ICO image can make a heap buffer overflow, crashing the process or potentially running code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:imgproxy affected >= 4.0.0, <= 4.0.15 fixed 4.0.16

## How to check

Run 'imgproxy version' or check your container image tag; versions 4.0.0 through 4.0.15 are vulnerable. Also check whether the instance accepts image URLs from untrusted users or sources (the ICO loader is reached when a file starts with the ICO magic bytes 00 00 01 00, whatever its extension).

## Fix

Upgrade imgproxy to 4.0.16 or later (maintainer's patched version). Later 4.0.x releases (4.0.17, 4.0.21) fix further ICO/BMP loader bugs, so move to the latest 4.0.x.

## Timeline

- 2026-11-08T02:21:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123614
- 2026-11-08T02:23:45+00:00 analyst https://docs.imgproxy.net/image_formats_support — Read maintainer GHSA-hff9-5pqw-6w9f: affected >=4.0.0 <=4.0.15, patched 4.0.16 (release notes linked). ICO is a supported source format in the docs; no setting to disable it found, so ICO decoding appears on by default (docs list it, advisory silent). No exploitation or PoC seen. Changelog shows later ICO/BMP loader fixes in 4.0.17 and 4.0.21, so advise latest 4.0.x. Not marking mitigations; none stated.

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/imgproxy/imgproxy/security/advisories/GHSA-hff9-5pqw-6w9f
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/imgproxy-4.0.0-before-4.0.16-heap-buffer-overflow-via-ico-loader-integer-overflow
- [describes] imgproxy image formats support https://docs.imgproxy.net/image_formats_support
- [fix] imgproxy v4.0.16 https://github.com/imgproxy/imgproxy/releases/tag/v4.0.16

## From the sources

imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vips/icoload.c, corrupting heap memory to crash the process or achieve code execution.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_