CVE-2026-123616
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Nov 08, 2026
Vendor
unknown
Description
imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the data_size field. Attackers can supply a crafted 23-byte ICO file declaring a ~4GB data_size to trigger memory exhaustion and worker crashes without authentication.