683 matches found
CVE-2026-120432
Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam that allows attackers to corrupt heap memory via oversized ICO/CUR dimensions. Attackers can supply a crafted icon file with width or height above 32767, wrapping int16t loop counters into...
EUVD-2026-115241
Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam that allows attackers to corrupt heap memory via oversized ICO/CUR dimensions. Attackers can supply a crafted icon file with width or height above 32767, wrapping int16t loop counters into...
CVE-2026-120432
Netpbm versions before 10.86.51 , 11.02.30 , and 11.15.08 are vulnerable to an integer overflow in the winicontopam component. An attacker can provide a crafted icon file with ICO/CUR dimensions exceeding 32767 , causing int16_t loop counters to wrap into negative row buffer indices. This leads t...
CVE-2026-120432 Netpbm before 10.86.51, 11.02.30, and 11.15.08 Integer Overflow in winicontopam
Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam that allows attackers to corrupt heap memory via oversized ICO/CUR dimensions. Attackers can supply a crafted icon file with width or height above 32767, wrapping int16t loop counters into...
gimp: gimp: heap-based buffer overflow in ICO loader via integer overflow in embedded PNG dimensions
A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pix...
CVE-2026-120432: Netpbm: Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam that allows…
Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam that allows attackers to corrupt heap memory via oversized ICO/CUR dimensions. Attackers can supply a crafted icon file with width or height above 32767, wrapping int16t loop counters into...
PT-2026-135448
Name of the Vulnerable Software and Affected Versions Netpbm versions prior to 10.86.51 Netpbm versions prior to 11.02.30 Netpbm versions prior to 11.15.08 Description Multiple issues exist in the software that can lead to crashes or remote code execution when processing crafted files. In the...
CLEANSTART-2024-WD83239 exploitable code execution vulnerability exists in the ICO image rendering functionality of SDL2_image-2
Security vulnerability affects the sdl2image package. An exploitable code execution vulnerability exists in the ICO image rendering functionality of SDL2image-2...
CLEANSTART-2026-DM91026 Integer overflow in io-ico
Security vulnerability affects the gdk-pixbuf package. Integer overflow in io-ico...
GHSA-HFF9-5PQW-6W9F imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution
Summary The ICO loader allocates datasize + BMPFILEHEADERLEN bytes after reading a 32-bit attacker-controlled datasize. For datasize UINT32MAX - BMPFILEHEADERLEN, the addition wraps before allocation. imgproxy then writes the ICO prefix and reads up to the original declared size starting 14 bytes...
imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution
Summary The ICO loader allocates datasize + BMPFILEHEADERLEN bytes after reading a 32-bit attacker-controlled datasize. For datasize UINT32MAX - BMPFILEHEADERLEN, the addition wraps before allocation. imgproxy then writes the ICO prefix and reads up to the original declared size starting 14 bytes...
GHSA-494M-4556-WF5P imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash
Summary Out-of-bounds heap write in imgproxy's ICO loader vips/icoload.c: when the ICO entry's image data buffer is small, the loader's BMP-header-reconstruction writes land past the allocation, corrupting the size field of the following heap chunk. The worker then aborts deterministically glibc...
imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash
Summary Out-of-bounds heap write in imgproxy's ICO loader vips/icoload.c: when the ICO entry's image data buffer is small, the loader's BMP-header-reconstruction writes land past the allocation, corrupting the size field of the following heap chunk. The worker then aborts deterministically glibc...
GHSA-MMQ5-XM89-9PFG imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field
Summary Unbounded and unvalidated memory allocation in imgproxy's ICO loader vips/icoload.c. An attacker-controlled datasize field u32 from the ICO directory entry is passed directly to VIPSMALLOC without any bounds check, so a single crafted 23-byte ICO file makes an imgproxy worker attempt a 4G...
imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field
Summary Unbounded and unvalidated memory allocation in imgproxy's ICO loader vips/icoload.c. An attacker-controlled datasize field u32 from the ICO directory entry is passed directly to VIPSMALLOC without any bounds check, so a single crafted 23-byte ICO file makes an imgproxy worker attempt a 4G...
CVE-2026-116724
FLTK through 1.4.5 contains an integer overflow vulnerability in FlBMPImage::loadbmp that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding writes file-derived data past the heap...
CVE-2026-110505
The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site...
CVE-2026-110504
The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks...
CVE-2026-110505 Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass
The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site...
EUVD-2026-112622
The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks...