Skip to content

CVE record · 1 source

CVE-2026-123616

CVSS 7.5

imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the data_size field.

Vendor: Imgproxy
Product: imgproxy
CVSS v3.1: 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-789

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

25

CVE NVD 5h ago

imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the data_size field.

imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the data_size field. Attackers can supply a crafted 23-byte ICO file declaring a ~4GB data_size to…

CVSS 7.5 CVE-2026-123616 Imgproxy