Read the docs
TI-2026-86757 Aliases CVE-2026-123615GHSA-c4x5-qr47-7gw4

Out-of-bounds write in imgproxy ICO loader crashes worker

Priority MEDIUM 53CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction. When an ICO entry declares a tiny data size, unvalidated header fields are read and written past the allocated buffer. An unauthenticated remote attacker can supply a crafted ICO image to corrupt adjacent heap chunk metadata, triggering a glibc abort that crashes the worker. The weakness is classified as CWE-787.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

Description from the CNA

imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction (vips_foreign_load_ico_header in vips/icoload.c) when an ICO entry declares a tiny data size, causing unvalidated header fields to be read and written past the allocated buffer. Unauthenticated remote attackers can supply a crafted ICO image to corrupt adjacent heap chunk metadata, triggering a glibc abort that crashes the worker.

Why it matters now

Fix Fixed imgproxy (imgproxy): 4.0.17

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
imgproxyimgproxy3.3.0 to before 4.0.174.0.17Patch availableCNA
  • imgproxy Vendorimgproxy Affected 3.3.0 to before 4.0.17 Fixed in 4.0.17 Patch available CNA

Remediation

Upgrade imgproxy to version 4.0.17 or later, which fixes the flaw in the affected 3.3.0 to before 4.0.17 range.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

  • Fix · CNA imgproxy (imgproxy) Fixed in 4.0.17

Timeline

  1. 2026-11-08 Threatist record created from CVE-2026-123615
  2. 2026-11-08 Alias added: GHSA-c4x5-qr47-7gw4

References

Advisory 1

  • TI-2026-86756 Heap buffer overflow in imgproxy ICO loader lets attackers crash or run code CVSS 4.0CRITICAL 9.3
  • TI-2026-86758 Memory exhaustion in imgproxy ICO loader enables denial of service CVSS 4.0HIGH 8.7
  • TI-2025-18097 imgproxy is vulnerable to SSRF against 0.0.0.0 CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences