CVE-2026-123615 imgproxy before 4.0.17 Out-of-Bounds Write in ICO Loader
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-123615?
CVE-2026-123615 is a high-severity vulnerability in imgproxy, published on 8 Nov 2026.
Official description
imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction (vips_foreign_load_ico_header in vips/icoload.c) when an ICO entry declares a tiny data size, causing unvalidated header fields to be read and written past the allocated buffer. Unauthenticated remote attackers can supply a crafted ICO image to corrupt adjacent heap chunk metadata, triggering a glibc abort that crashes the worker.
Weakness: CWE-787
Which versions are affected by CVE-2026-123615?
5 open source packages ship an affected version, including github.com/imgproxy/imgproxy/v3, github.com/imgproxy/imgproxy and github.com/imgproxy/imgproxy/v2.
| Package | Affected | Fixed in |
|---|---|---|
github.com/imgproxy/imgproxy/v3 Go | From 3.3.0 | None |
github.com/imgproxy/imgproxy/v3 Go | From 3.3.0 | 4.0.17 |
github.com/imgproxy/imgproxy Go | All versions | None |
github.com/imgproxy/imgproxy/v2 Go | All versions | None |
github.com/imgproxy/imgproxy/v4 Go | All versions | 4.0.17 |
How do I fix CVE-2026-123615?
Upgrade github.com/imgproxy/imgproxy/v3 to 4.0.17 or later.
Is CVE-2026-123615 being exploited?
There is no known exploitation of CVE-2026-123615 in the wild and no public exploit code.
Sources
Also known as GHSA-494m-4556-wf5p, GHSA-c4x5-qr47-7gw4, GO-2026-6895.