critical · CVSS v3 9.8 · CVSS v4 9.3

CVE-2026-123614

Imgproxy versions 4.0.0 through 4.0.15 contain an integer overflow in the ICO loader that can be exploited via a crafted data_size value. Th

Overview

Imgproxy versions 4.0.0 through 4.0.15 contain an integer overflow in the ICO loader that can be exploited via a crafted data_size value. The flaw leads to a heap buffer overflow, potentially crashing the process or allowing code execution. This vulnerability is critical and can be triggered remotely by submitting a malicious ICO image.

Description

imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vips/icoload.c, corrupting heap memory to crash the process or achieve code execution.

Impact

The vulnerability compromises availability by crashing the image processing service and may lead to integrity and confidentiality breaches if an attacker achieves code execution. Defenders of web applications, CDNs, or any service that relies on imgproxy for image manipulation are directly impacted.

Remediation

Upgrade imgproxy to version 4.0.16 or later. If an upgrade is not immediately possible, disable ICO image support or enforce strict size limits on uploaded images, and monitor for anomalous image processing requests. Apply any vendor‑issued patches and consider network filtering to block suspicious ICO traffic.

Risk context

The CVSS v3 score of 9.8 and critical severity indicate a high‑risk flaw with immediate impact. Defenders should prioritize remediation without delay.

Affected products

  • imgproxy 4.0.0-4.0.15

Scores

Severity
critical
CVSS v2
10
CVSS v3
9.8
CVSS v4
9.3
EPSS
—

integer-overflow heap-buffer-overflow ICO imgproxy critical image-processing

← All CVEs

Related CVEs

critical

CVE-2026-123531

Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass service.maxitemsperpage by sending page=0 to /api/v1 list endpoints. Attackers can self-register and repeatedly request page=0 to force unbounded SQL queries, memory materialisation, and per-row query fan-out, degrading availability for other users.

View analysis

critical

CVE-2026-123549

OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous attackers to set restricted attributes including group membership. Attackers can register through the legacy self-service REST endpoint or User Self-Service flow to join administrative groups and gain full administrative control of OpenAM.

View analysis

critical

CVE-2026-123550

OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submit forged assertions to obtain sessions as any mapped user, including administrators, and hijack single sign-on to dependent applications.

View analysis

critical

CVE-2026-123551

OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints, collecting iPlanetDirectoryPro tokens to hijack user and administrator sessions.

View analysis