imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction (vips_foreign_load_ico_header in vips/icoload.c) when an ICO entry declares a tiny data size, causing unvalidated header fields to be read and written past the allocated buffer. Unauthenticated remote attackers can supply a crafted ICO image to corrupt adjacent heap chunk metadata, triggering a glibc abort that crashes the worker.
Metrics
Affected Vendors & Products
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Sun, 08 Nov 2026 01:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction (vips_foreign_load_ico_header in vips/icoload.c) when an ICO entry declares a tiny data size, causing unvalidated header fields to be read and written past the allocated buffer. Unauthenticated remote attackers can supply a crafted ICO image to corrupt adjacent heap chunk metadata, triggering a glibc abort that crashes the worker. | |
| Title | imgproxy before 4.0.17 Out-of-Bounds Write in ICO Loader | |
| First Time appeared |
Evilmartians
Evilmartians imgproxy |
|
| Weaknesses | CWE-787 | |
| CPEs | cpe:2.3:a:evilmartians:imgproxy:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Evilmartians
Evilmartians imgproxy |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-11-08T01:38:39.703Z
Reserved: 2026-11-06T01:04:42.201Z
Link: CVE-2026-123615
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses