CVE-2026-123614 | BDVDB-2026-401971 Detail
imgproxyimgproxy
Description#
imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vips/icoload.c, corrupting heap memory to crash the process or achieve code execution.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-122 Heap-based Buffer Overflow
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.