Advisory · CVE-2026-123614
Crafted ICO images can crash or take over imgproxy workers
imgproxy 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that lets remote attackers trigger a heap buffer overflow via a crafted data_size value, rated critical at CVSS 9.8; fixed in 4.0.16.
- Vendor
- imgproxy
- Product
- imgproxy
- Identifier / CWE
- CVE-2026-123614
CWE-122 - Action timing
- Immediate
Explain it like I’m five
imgproxy resizes images for websites, and it trusts the size number written inside an ICO image file. A lying size number makes it reserve the wrong amount of memory, and the overflow that follows can crash the worker or run the attacker's code.
- 01Crafted ICO submitted
An attacker supplies an ICO image with a malicious data_size value to an imgproxy endpoint.
- 02Size wraps
The value overflows the allocation calculation in the ICO loader.
- 03Heap corrupted
The undersized buffer is overrun when the image data is written.
- 04Worker crashes or code runs
The process crashes, or the memory corruption leads to code execution in the worker.
What happened
imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation, corrupting heap memory to crash the process or achieve code execution. The record rates it critical at CVSS 9.8 under version 3.1, with network attack vector, low complexity, no privileges required, and no user interaction.
imgproxy sits on the image path for many sites and processes attacker-supplied files by design, so a crafted image is a normal request, not an anomaly. The flaw is fixed in imgproxy 4.0.16.
What to do
- Inventory imgproxy deployments and record each version.
- Upgrade to imgproxy 4.0.16 or later.
- Until upgraded, restrict which sources can submit images for processing where the deployment allows it.
- Monitor worker crashes and restarts around ICO processing.
- Verify the deployed version after updating.
Management note
A remote code execution path in a service that eats untrusted files is a top-priority patch. The crafted input looks like ordinary image traffic, so do not rely on request filtering to catch it.