Advisory · CVE-2026-123616
A 23-byte ICO file can exhaust imgproxy memory with a fake 4GB size claim
imgproxy 3.3.0 before 4.0.16 contains an unbounded memory allocation flaw in the ICO loader that fails to validate the data_size field, letting attackers supply a crafted 23-byte ICO file declaring a roughly 4GB data size to trigger memory exhaustion and worker crashes, rated high at CVSS 8.7 under version 4.0; fixed in 4.0.16.
- Vendor
- imgproxy
- Product
- imgproxy
- Identifier / CWE
- CVE-2026-123616
CWE-789 - Action timing
- Immediate
Explain it like I’m five
imgproxy believes the size written in an ICO file and tries to set aside that much memory. A 23-byte file claiming to be 4 gigabytes makes it grab memory until the worker falls over.
- 01Tiny file, huge claim
An attacker sends a 23-byte ICO file declaring a roughly 4GB data_size.
- 02No validation
The ICO loader allocates based on the declared size without checking it.
- 03Memory exhausted
The worker's memory is consumed by the oversized allocation.
- 04Worker crashes
Image processing stops for that worker until it restarts.
What happened
imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation flaw in the ICO loader that fails to validate the data_size field. Attackers can supply a crafted 23-byte ICO file declaring a roughly 4GB data_size to trigger memory exhaustion and worker crashes without authentication. The record rates it high at CVSS 8.7 under version 4.0, with network attack vector, low complexity, no privileges required, and no user interaction.
The asymmetry is the story: 23 bytes of input against gigabytes of allocation. A single request can take a worker down, and the input looks like an ordinary image upload. The flaw is fixed in imgproxy 4.0.16.
What to do
- Inventory imgproxy deployments and record each version.
- Upgrade to imgproxy 4.0.16 or later.
- Until upgraded, restrict which sources can submit images for processing where the deployment allows it.
- Monitor worker memory use and restarts around ICO processing.
- Verify the deployed version after updating.
Management note
Denial of service by 23-byte file is cheap enough to be automated at scale. Patching is the fix; rate limits only slow an attack that costs the attacker nothing.