Skip to content
Threat Feed
Subscribe
critical advisory exploited

imgproxy: Heap buffer overflow in ICO loader (CVE-2026-123614)

imgproxy versions 4.0.0 through 4.0.15 contain an integer overflow in the ICO image loader, enabling remote attackers to trigger heap memory corruption leading to potential code execution.

CVE search metadata

CVE search record: CVE-2026-123614. Severity: critical. CVSS: 9.8. KEV: no. Product: imgproxy (>= 4.0.0, < 4.0.16). Brief: imgproxy: Heap buffer overflow in ICO loader (CVE-2026-123614). Brief link: https://feed.craftedsignal.io/briefs/2026-11-08-imgproxy-cve-2026-123614/

Triage facts

Revision 2
Applicability
imgproxy (>= 4.0.0, < 4.0.16)
Evidence
Confirmed activeHigh confidence
Severity
Critical
Action
Immediate escalation
Sources
2 public sources
Freshness
Revision 2Nov 8, 03:36 UTC
Detection
1 IOC
Vulnerabilities
1 CVE
Source quality
A1Likely
Revision history 1 entry · Revision 2
  1. Revision 2

    exploited:true

    Changed: claim_state, exploitation_evidence, iocs, lastmod, references, updates

    Sources: 1

imgproxy versions 4.0.0 to 4.0.15 are affected by an integer overflow vulnerability in the ICO image loader component. An attacker can craft an ICO image with a specifically manipulated data_size parameter. When processed by the application, this value triggers an integer overflow in the memory allocation logic within the vips/icoload.c source file. This results in a heap buffer overflow, which can be leveraged to crash the service (Denial of Service) or execute arbitrary code.

Impact

Successful exploitation allows remote, unauthenticated attackers to cause a process crash or potentially achieve remote code execution on the server running imgproxy.

Recommendation

  • Upgrade imgproxy to version 4.0.16 or later immediately.
  • Audit logs for repeated crashes or unusual memory spikes associated with the imgproxy service, which may indicate exploitation attempts.

Immediate actions

Upgrade imgproxy to version 4.0.16 or later

IT Operations 24h

Threat Hunt

Monitor for imgproxy process crashes or SIGSEGV errors in system/container logs

T1203 high medium confidence hunt now

Data: Container orchestrator logs (e.g., Kubernetes Events), Application stdout/stderr logs

Mitigations

Upgrade imgproxy to 4.0.16

immediate IT Operations

CVE-2026-123614

Indicators of compromise

1

hash_sha256

TypeValue
hash_sha2566cee1fbfdc69fd4f507e86835ce2fa54519e55608f1dd69f42860f9961b1045b