CVE-2026-123614 in imgproxy
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vips/icoload.c, corrupting heap memory to crash the process or achieve code execution.
Affected software: imgproxy
Scores
- CVSS: 9.3 (critical)
- EPSS: 0.66% chance of exploitation in the next 30 days
- CISA KEV: Not listed
- Published: 2026-11-08
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Upgrade imgproxy to 4.0.16 or later (ICO loader heap overflow, CVE-2026-123614)
Patch or upgrade. imgproxy 4.0.0 to 4.0.15 overflows a heap buffer when it decodes a crafted ICO image, which can crash the process or run code. 4.0.16 fixes it.
Applies to: imgproxy 4.0.0 to before 4.0.16
- Find imgproxy deployments (container images ghcr.io/imgproxy/imgproxy or darthsim/imgproxy) and check their version.
- Move to imgproxy 4.0.16 or later and redeploy.
- Until then, leave ICO out of IMGPROXY_ALLOWED_SOURCE_FORMATS (or the equivalent allowlist) and only allow trusted image sources.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.