# CVE-2026-123615

Heap OOB read/write in imgproxy ICO loader allows remote crash (unauthenticated DoS).

- Page: https://www.vulneraibility.com/cve/CVE-2026-123615
- CVSS: 8.7
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.53% (percentile 45.3)
- Weakness: CWE-787
- Also known as: GHSA-494m-4556-wf5p, GO-2026-6895
- Published: 2026-11-08

## Affected versions

- imgproxy: affected >= 3.3.0 and < 4.0.17; fixed in 4.0.17

A version outside these ranges is not a statement that it is unaffected.

## Impact

Unauthenticated remote heap corruption via crafted ICO images causing worker crash and glibc abort (remote DoS); may corrupt heap metadata.

## Action

Patch when possible

## Recommendation

Upgrade imgproxy to >= 4.0.17; block/scan untrusted ICO uploads.

## References

- [advisory] https://github.com/imgproxy/imgproxy/security/advisories/GHSA-494m-4556-wf5p
- [advisory] https://www.vulncheck.com/advisories/imgproxy-before-4.0.17-out-of-bounds-write-in-ico-loader

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.