CVE-2026-123616

CVE-2026-123616CVE-2026-123616

Description

imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the data_size field. Attackers can supply a crafted 23-byte ICO file declaring a ~4GB data_size to trigger memory exhaustion and worker crashes without authentication.

Scoring

CVSS 7.5 ()
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Last modified2026-11-08
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.