{"id":"CVE-2026-123615","title":"imgproxy before 4.0.17 Out-of-Bounds Write in ICO Loader","summary":"imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction (vips_foreign_load_ico_header in vips/icoload.c) when an ICO entry declares a tiny data size, causing unvalidated he…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-787"],"vendor":"imgproxy","product":"imgproxy","affected":["imgproxy >= 3.3.0 < 4.0.17"],"published":"2026-11-08","updated":"2026-11-08","sourceUpdated":"2026-11-08T01:38:39.703Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-123615","references":[{"url":"https://github.com/imgproxy/imgproxy/security/advisories/GHSA-494m-4556-wf5p","label":"GitHub Security Advisory (GHSA-494m-4556-wf5p)"},{"url":"https://www.vulncheck.com/advisories/imgproxy-before-4.0.17-out-of-bounds-write-in-ico-loader","label":"VulnCheck Advisory: imgproxy before 4.0.17 Out-of-Bounds Write in ICO Loader"}],"tags":["cve.org"],"ingestedAt":"2026-11-08T02:43:18.636Z","slug":"CVE-2026-123615","body":"## Overview\n\nimgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction (vips_foreign_load_ico_header in vips/icoload.c) when an ICO entry declares a tiny data size, causing unvalidated header fields to be read and written past the allocated buffer. Unauthenticated remote attackers can supply a crafted ICO image to corrupt adjacent heap chunk metadata, triggering a glibc abort that crashes the worker.\n\n## Affected\n\n- `imgproxy >= 3.3.0 < 4.0.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}