{"id":"CVE-2026-123614","published":"2026-11-08T02:16:56.983","lastModified":"2026-11-09T14:17:13.197","description":"imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vips/icoload.c, corrupting heap memory to crash the process or achieve code execution.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-122"],"vendors":[],"products":[],"references":[{"url":"https://github.com/imgproxy/imgproxy/security/advisories/GHSA-hff9-5pqw-6w9f","tags":[]},{"url":"https://www.vulncheck.com/advisories/imgproxy-4.0.0-before-4.0.16-heap-buffer-overflow-via-ico-loader-integer-overflow","tags":[]}],"exploitRefs":[{"url":"https://github.com/imgproxy/imgproxy/security/advisories/GHSA-hff9-5pqw-6w9f","tags":[]}],"hasPoc":true,"ai":{"summary":"imgproxy versions 4.0.0 through 4.0.15 contain an integer overflow in the ICO image loader (vips/icoload.c) that leads to a heap buffer overflow when processing a specially crafted ICO file with a wrapped data_size value. This allows unauthenticated remote attackers to crash the service or potentially achieve remote code execution.","exploitability":"Exploitation requires submitting a maliciously crafted ICO image to imgproxy, but no authentication or user interaction is needed, making it trivial for remote attackers to attempt exploitation over the network.","blast_radius":"Successful exploitation could lead to full system compromise of the imgproxy server, enabling data exfiltration, service disruption, or use as a pivot point within the infrastructure.","remediation":"Upgrade to imgproxy version 4.0.16 or later, which contains the fix for the integer overflow in the ICO loader.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["heap-overflow","integer-overflow","rce","web","ics"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:46:29.333Z"}}