CVE-2026-123615 | imgproxy up to 4.0.16 ICO Loader vips/icoload.c vips_foreign_load_ico_header out-of-bounds

A vulnerability labeled as critical has been found in imgproxy up to 4.0.16. This affects the function vips_foreign_load_ico_header of the file vips/icoload.c of the component ICO Loader. Such manipulation leads to out-of-bounds read.

This vulnerability is traded as CVE-2026-123615. The attack may be launched remotely. There is no exploit available.

The affected component should be upgraded.VulDB Recent EntriesRead More