imgproxy ICO Loader Integer Overflow (CVE-2026-123614)

The loader allocates a memory buffer sized from a 32-bit value taken out of the ICO file's own header, plus a small fixed header length.

GitHub's advisory, GHSA-hff9-5pqw-6w9f, says that when an attacker picks that header value large enough, the addition wraps around in 32-bit arithmetic. The allocation call then receives a number far smaller than the loader expects, so imgproxy sets aside too little memory for the image data that follows.

What an Attacker Gains

The advisory says the loader then writes a short header into the undersized buffer. It then copies in the amount of image data the attacker originally declared, not the smaller amount that was actually allocated. That copy runs past the end of the buffer and corrupts memory on the process heap.

GitHub's advisory says a network client can turn this heap overflow into a remote denial of service. It adds that the corrupted heap may potentially lead to remote code execution. It credits mateofumis and JasonPuglisi as reporters and JacobBrackett as the analyst who verified the issue.

How the Score Reads

VulnCheck, the CNA that assigned CVE-2026-123614, scores it CVSS 3.1 9.8 Critical, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The same advisory gives CVSS 4.0 9.3 Critical. Its vector is AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

Both vectors read the flaw as reachable over the network, needing no privileges and no user interaction. See our CVSS entry for how to read the vector.

What imgproxy and CISA KEV Say

imgproxy's maintainers released the fix in version 4.0.16 on 28 September 2026. The release note says only, "Fixed several vulnerabilities in ICO image loader." As of CISA catalog version 2026.11.06, CVE-2026-123614 is not in the Known Exploited Vulnerabilities catalog. Our KEV glossary entry explains the catalog.

The CVE record lists imgproxy as affected from version 4.0.0 up to but not including 4.0.16. GitHub's advisory gives the same range as 4.0.0 through 4.0.15, with 4.0.16 as the first patched release.

The CVE record names the affected package as pkg:golang/github.com/imgproxy/imgproxy/v4, the Go module that imgproxy ships as. Any deployment that builds on this module and accepts images from outside sources carries the flaw until it moves past 4.0.15.

The advisory names no separate workaround or setting that turns ICO loading off. We recommend upgrading promptly, and in the meantime watching for crashes or unexpected restarts on any imgproxy instance that accepts uploads or fetches from untrusted sources. See our vulnerability management guide for how to prioritize a patch like this one.