imgproxy ICO loader: unauthenticated integer overflow may allow RCE, plus heap OOB and memory-exhaustion DoS (GHSA-hff9-5pqw-6w9f / 494m / mmq5)

imgproxy's ICO loader (vips/icoload.c) has three related flaws reachable with a crafted image. GHSA-hff9-5pqw-6w9f is a critical unauthenticated integer overflow: an attacker-controlled 32-bit data_size wraps when BMP_FILE_HEADER_LEN is added, so the process allocates a few bytes then writes far past the buffer — GitHub rates it CVSS 3.1 9.8 and says the heap overflow can cause denial of service or remote code execution. GHSA-mmq5-xm89-9pfg (high, CVSS 7.5) passes the same data_size to VIPS_MALLOC without a bound, so a tiny ICO can force a multi-gigabyte allocation. GHSA-494m-4556-wf5p (high, CVSS 7.5) reconstructs a BMP header from unvalidated fields and can write out of bounds, crashing the worker. Fixed in v4.0.16 (overflow + unbounded alloc) and v4.0.17 (OOB heap R/W). Also tracked as GO-2026-6897, GO-2026-6898 and GO-2026-6895.

Why this severity: GHSA-hff9-5pqw-6w9f Critical CVSS 3.1 9.8 (unauth integer overflow → possible RCE); sibling ICO-loader DoS advisories GHSA-mmq5-xm89-9pfg and GHSA-494m-4556-wf5p High CVSS 7.5

Started

Oct 30, 2026

• Go
• #imgproxy
• RCE
• #DoS
• #Image processing