Description
imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vips/icoload.c, corrupting heap memory to crash the process or achieve code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| imgproxy | imgproxy | 4.0.0 – < 4.0.16 | 4.0.16 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/imgproxy/imgproxy | >= 4.0.0, < 4.0.16 | 4.0.16 | GHSA-hff9-5pqw-6w9f |
| Go | github.com/imgproxy/imgproxy | all versions | — | GO-2026-6897 |
| Go | github.com/imgproxy/imgproxy/v2 | >= 4.0.0, < 4.0.16 | 4.0.16 | GHSA-hff9-5pqw-6w9f |
| Go | github.com/imgproxy/imgproxy/v2 | all versions | — | GO-2026-6897 |
| Go | github.com/imgproxy/imgproxy/v3 | >= 4.0.0, < 4.0.16 | 4.0.16 | GHSA-hff9-5pqw-6w9f |
| Go | github.com/imgproxy/imgproxy/v3 | all versions | — | GO-2026-6897 |
| Go | github.com/imgproxy/imgproxy/v4 | >= 4.0.0, < 4.0.16 | 4.0.16 | GO-2026-6897 |
References
- GitHub Security Advisory (GHSA-hff9-5pqw-6w9f) vendor-advisory
- VulnCheck Advisory: imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflow third-party-advisory