Out-of-Bounds Write Vulnerability in imgproxy by imgproxy

CVE-2026-123615

What is CVE-2026-123615?

Certain versions of imgproxy prior to 4.0.17 are susceptible to an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction. This vulnerability arises when an ICO entry specifies a minimal data size, allowing unauthenticated remote attackers to exploit unvalidated header fields. Such exploitation could lead to reading from and writing past the allocated buffer, potentially leading to corruption of adjacent heap metadata. This condition can cause a glibc abort, resulting in the crashing of the worker process.

References