{"id":"CVE-2026-123615","kind":"vulnerability","aliases":["CVE-2026-123615"],"related":[],"title":"imgproxy: crafted ICO image corrupts heap and crashes the worker","description":"imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction (vips_foreign_load_ico_header in vips/icoload.c) when an ICO entry declares a tiny data size, causing unvalidated header fields to be read and written past the allocated buffer. Unauthenticated remote attackers can supply a crafted ICO image to corrupt adjacent heap chunk metadata, triggering a glibc abort that crashes the worker.","summary":"imgproxy 3.3.0 before 4.0.17 reads and writes past a heap buffer when its ICO loader rebuilds a BMP header from an entry with a tiny declared data size. An unauthenticated remote attacker can send a crafted ICO image to corrupt heap metadata and crash the worker process.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["docker","imgproxy","package","self-hosted"],"not_affected_if":["ico-disabled","trusted-sources-only"],"how_to_check":"- Check the imgproxy version in use, for example `imgproxy version` or the Docker image tag\n- Confirm whether the deployment accepts remote source images (`IMGPROXY_ALLOW_...` and source URL settings) so untrusted ICO files reach the loader","fix":"- imgproxy: move to `4.0.17` or later (the fix is in 4.0.17 per the description; 3.3.0 and earlier 3.x affected)","status":"open","published_at":"2026-11-08T02:16:57+00:00","first_seen_at":"2026-11-08T02:21:14+00:00","triaged_at":"2026-11-08T02:22:43+00:00","updated_at":"2026-11-08T02:22:43+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:22:43Z","model":"claude-haiku-5-5","output":{"fix":"- imgproxy: move to `4.0.17` or later (the fix is in 4.0.17 per the description; 3.3.0 and earlier 3.x affected)","reach":"internet","title":"imgproxy: crafted ICO image corrupts heap and crashes the worker","impact":"medium","summary":"imgproxy 3.3.0 before 4.0.17 reads and writes past a heap buffer when its ICO loader rebuilds a BMP header from an entry with a tiny declared data size. An unauthenticated remote attacker can send a crafted ICO image to corrupt heap metadata and crash the worker process.","audience":"businesses","category":"package","nicknames":[],"who_cares":["imgproxy","self-hosted","docker"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Remote attacker crashes imgproxy worker via heap corruption","analyst_note":"Confirm exact affected range and whether code execution is possible beyond the crash, using the maintainer advisory on github.com and the VulnCheck advisory.","how_to_check":"- Check the imgproxy version in use, for example `imgproxy version` or the Docker image tag\n- Confirm whether the deployment accepts remote source images (`IMGPROXY_ALLOW_...` and source URL settings) so untrusted ICO files reach the loader\n- unknown whether ICO input is disabled by any setting","plain_action":"","needs_analyst":true,"not_affected_if":["trusted-sources-only","ico-disabled"],"who_is_affected":"Teams running imgproxy 3.3.0 through 4.0.16 that process images from untrusted sources, such as public URLs or user uploads, are exposed because the crafted ICO image reaches the vulnerable loader unauthenticated. Deployments that only resize trusted internal images or do not accept ICO input are at lower risk. Whether ICO support can be turned off is unknown from the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000787,"input_tokens":4350,"output_tokens":704,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123615':13A,16A '-2026':12A,15A '3.3.0':24B,71C '4.0.17':26B,73C 'abort':139C 'adjac':132C 'alloc':119C 'attack':54B,123C 'bmp':40B,89C 'bound':79C 'buffer':33B,120C 'caus':108C 'chunk':134C 'contain':74C 'corrupt':5A,62B,131C 'craft':2A,58B,127C 'crash':8A,66B,141C 'cve':11A,14A 'data':49B,106C 'declar':48B,103C 'docker':17B 'entri':44B,102C 'field':111C 'foreign':93C 'glibc':138C 'header':41B,90C,96C,110C 'heap':6A,32B,63B,80C,133C 'host':22B 'ico':3A,36B,59B,86C,95C,101C,128C 'imag':4A,60B,129C 'imgproxi':1A,18B,23B,70C 'load':94C 'loader':37B,87C 'metadata':64B,135C 'out-of-bound':76C 'packag':19B 'past':30B,117C 'process':69B 'read':27B,81C,114C 'rebuild':38B 'reconstruct':91C 'remot':53B,122C 'self':21B 'self-host':20B 'send':56B 'size':50B,107C 'suppli':125C 'tini':47B,105C 'trigger':136C 'unauthent':52B,121C 'unvalid':109C 'vip':92C 'vips/icoload.c':98C 'worker':10A,68B,143C 'write':29B,83C 'written':116C","nicknames":[],"mitigations":[],"who_affected":"Teams running imgproxy 3.3.0 through 4.0.16 that process images from untrusted sources, such as public URLs or user uploads, are exposed because the crafted ICO image reaches the vulnerable loader unauthenticated. Deployments that only resize trusted internal images or do not accept ICO input are at lower risk. Whether ICO support can be turned off is unknown from the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["docker","high","imgproxy","package","selfhosted"],"campaign_type":null,"search_a":"'-123615':13A,16A '-2026':12A,15A 'corrupt':5A 'craft':2A 'crash':8A 'cve':11A,14A 'heap':6A 'ico':3A 'imag':4A 'imgproxi':1A 'worker':10A","search_b":"'3.3.0':24B '4.0.17':26B 'attack':54B 'bmp':40B 'buffer':33B 'corrupt':62B 'craft':58B 'crash':66B 'data':49B 'declar':48B 'docker':17B 'entri':44B 'header':41B 'heap':32B,63B 'host':22B 'ico':36B,59B 'imag':60B 'imgproxi':18B,23B 'loader':37B 'metadata':64B 'packag':19B 'past':30B 'process':69B 'read':27B 'rebuild':38B 'remot':53B 'self':21B 'self-host':20B 'send':56B 'size':50B 'tini':47B 'unauthent':52B 'worker':68B 'write':29B","search_c":"'3.3.0':71C '4.0.17':73C 'abort':139C 'adjac':132C 'alloc':119C 'attack':123C 'bmp':89C 'bound':79C 'buffer':120C 'caus':108C 'chunk':134C 'contain':74C 'corrupt':131C 'craft':127C 'crash':141C 'data':106C 'declar':103C 'entri':102C 'field':111C 'foreign':93C 'glibc':138C 'header':90C,96C,110C 'heap':80C,133C 'ico':86C,95C,101C,128C 'imag':129C 'imgproxi':70C 'load':94C 'loader':87C 'metadata':135C 'out-of-bound':76C 'past':117C 'read':81C,114C 'reconstruct':91C 'remot':122C 'size':107C 'suppli':125C 'tini':105C 'trigger':136C 'unauthent':121C 'unvalid':109C 'vip':92C 'vips/icoload.c':98C 'worker':143C 'write':83C 'written':116C","first_public_at":"2026-10-06T15:29:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123615","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123615","severity":null,"published_at":"2026-11-08T02:16:57+00:00","modified_at":"2026-11-08T02:16:57+00:00","first_seen_at":"2026-11-08T02:21:14+00:00","fetched_at":"2026-11-08T02:21:14+00:00","note":null}],"documents":[{"id":26514,"url":"https://github.com/imgproxy/imgproxy/security/advisories/GHSA-494m-4556-wf5p","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-10-06T15:29:47+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99383,"url":"https://www.vulncheck.com/advisories/imgproxy-before-4.0.17-out-of-bounds-write-in-ico-loader","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}