Imgproxy vulnerabilities
We track 3 vulnerabilities in Imgproxy products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on November 8, 2026.
Latest Imgproxy vulnerabilities
- 7.5 High severity
imgproxy: Memory Allocation with Excessive Size Value
imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the data_size field. Attackers can supply a crafted 23-byte ICO file declaring a ~4GB data_size to trigger memory exhaustion and wo
- 7.5 High severity
imgproxy: Out-of-bounds Write
imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction (vips_foreign_load_ico_header in vips/icoload.c) when an ICO entry declares a tiny data size, causing unvalidated header fields to be read
- 9.8 Critical severity
imgproxy: Heap-based Buffer Overflow
imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vips