Imgproxy (< 4.0.16) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/imgproxy--4.0.16/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 08 Nov 2026 02:55:39 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgimgproxy: Heap buffer overflow in ICO loader (CVE-2026-123614)https://feed.craftedsignal.io/briefs/2026-11-08-imgproxy-cve-2026-123614/Sun, 08 Nov 2026 02:55:39 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-08-imgproxy-cve-2026-123614/imgproxy versions 4.0.0 through 4.0.15 contain an integer overflow in the ICO image loader, enabling remote attackers to trigger heap memory corruption leading to potential code execution.imgproxy versions 4.0.0 to 4.0.15 are affected by an integer overflow vulnerability in the ICO image loader component. An attacker can craft an ICO image with a specifically manipulated data_size parameter. When processed by the application, this value triggers an integer overflow in the memory allocation logic within the vips/icoload.c source file. This results in a heap buffer overflow, which can be leveraged to crash the service (Denial of Service) or execute arbitrary code.

Impact

Successful exploitation allows remote, unauthenticated attackers to cause a process crash or potentially achieve remote code execution on the server running imgproxy.

Recommendation

  • Upgrade imgproxy to version 4.0.16 or later immediately.
  • Audit logs for repeated crashes or unusual memory spikes associated with the imgproxy service, which may indicate exploitation attempts.
]]>criticaladvisorycve-2026-123614integer-overflowmemory-corruptionremote-code-execution