Advisory · CVE-2026-123615
imgproxy ICO loader writes past its buffer on tiny declared image sizes
imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction when an ICO entry declares a tiny data size, letting unauthenticated remote attackers corrupt adjacent heap chunk metadata and crash the worker, rated high at CVSS 8.7 under version 4.0; fixed in 4.0.17.
- Vendor
- imgproxy
- Product
- imgproxy
- Identifier / CWE
- CVE-2026-123615
CWE-787 - Action timing
- Immediate
Explain it like I’m five
When an ICO image claims a very small data size, imgproxy rebuilds its header by reading and writing past the end of the memory it set aside. The corrupted memory makes the worker crash.
- 01Tiny data size declared
A crafted ICO entry declares a small data size.
- 02Header rebuilt unchecked
BMP header reconstruction reads and writes header fields past the allocated buffer.
- 03Heap metadata corrupted
Adjacent heap chunk metadata is overwritten.
- 04Worker aborts
The memory allocator detects the corruption and the worker crashes.
What happened
imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader’s BMP header reconstruction when an ICO entry declares a tiny data size, causing unvalidated header fields to be read and written past the allocated buffer. Unauthenticated remote attackers can supply a crafted ICO image to corrupt adjacent heap chunk metadata, triggering an abort that crashes the worker. The record rates it high at CVSS 8.7 under version 4.0, with network attack vector, low complexity, no privileges required, and no user interaction.
This is a second memory-safety flaw in the same ICO loader, fixed in a later release than its sibling overflow. Deployments on 4.0.16 still need 4.0.17. The flaw is fixed in imgproxy 4.0.17.
What to do
- Inventory imgproxy deployments and record each version.
- Upgrade to imgproxy 4.0.17 or later.
- Until upgraded, restrict which sources can submit images for processing where the deployment allows it.
- Monitor worker crashes and restarts around ICO processing.
- Verify the deployed version after updating.
Management note
Two memory bugs in one image loader in one week is a sign the parser needs the upgrade, not a workaround. Note the fix version is 4.0.17, one release past the sibling flaw.