CVE-2026-123614 imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflow
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-123614?
CVE-2026-123614 is a critical vulnerability in imgproxy, published on 8 Nov 2026.
Official description
imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vips/icoload.c, corrupting heap memory to crash the process or achieve code execution.
Weakness: CWE-122
Which versions are affected by CVE-2026-123614?
7 open source packages ship an affected version, including github.com/imgproxy/imgproxy, github.com/imgproxy/imgproxy/v2 and github.com/imgproxy/imgproxy/v3.
| Package | Affected | Fixed in |
|---|---|---|
github.com/imgproxy/imgproxy Go | All versions | None |
github.com/imgproxy/imgproxy Go | From 4.0.0 | 4.0.16 |
github.com/imgproxy/imgproxy/v2 Go | All versions | None |
github.com/imgproxy/imgproxy/v2 Go | From 4.0.0 | 4.0.16 |
github.com/imgproxy/imgproxy/v3 Go | All versions | None |
github.com/imgproxy/imgproxy/v3 Go | From 4.0.0 | 4.0.16 |
1 more packages
github.com/imgproxy/imgproxy/v4 Go | From 4.0.0 | 4.0.16 |
How do I fix CVE-2026-123614?
Upgrade github.com/imgproxy/imgproxy to 4.0.16 or later.
Is CVE-2026-123614 being exploited?
There is no known exploitation of CVE-2026-123614 in the wild and no public exploit code.
Sources
Also known as GHSA-hff9-5pqw-6w9f, GHSA-p65x-p3jr-w89f, GO-2026-6897.