{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "imgproxy ICO loader: unauthenticated integer overflow may allow RCE, plus heap OOB and memory-exhaustion DoS (GHSA-hff9-5pqw-6w9f / 494m / mmq5) · updates",
  "home_page_url": "https://pwn.watch/i/imgproxy-ico-loader-rce-dos-ghsa-hff9-5pqw-6w9f",
  "feed_url": "https://pwn.watch/i/imgproxy-ico-loader-rce-dos-ghsa-hff9-5pqw-6w9f/feed.json",
  "description": "imgproxy's ICO loader (vips/icoload.c) has three related flaws reachable with a crafted image. GHSA-hff9-5pqw-6w9f is a critical unauthenticated integer overflow: an attacker-controlled 32-bit data_size wraps when BMP_FILE_HEADER_LEN is added, so the process allocates a few bytes then writes far past the buffer — GitHub rates it CVSS 3.1 9.8 and says the heap overflow can cause denial of service or remote code execution. GHSA-mmq5-xm89-9pfg (high, CVSS 7.5) passes the same data_size to VIPS_MALLOC without a bound, so a tiny ICO can force a multi-gigabyte allocation. GHSA-494m-4556-wf5p (high, CVSS 7.5) reconstructs a BMP header from unvalidated fields and can write out of bounds, crashing the worker. Fixed in v4.0.16 (overflow + unbounded alloc) and v4.0.17 (OOB heap R/W). Also tracked as GO-2026-6897, GO-2026-6898 and GO-2026-6895.",
  "language": "en",
  "_pwn": {
    "slug": "imgproxy-ico-loader-rce-dos-ghsa-hff9-5pqw-6w9f",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/imgproxy-ico-loader-rce-dos-ghsa-hff9-5pqw-6w9f/feed.xml",
    "llms": "https://pwn.watch/i/imgproxy-ico-loader-rce-dos-ghsa-hff9-5pqw-6w9f/llms.txt",
    "json": "https://pwn.watch/i/imgproxy-ico-loader-rce-dos-ghsa-hff9-5pqw-6w9f.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/imgproxy-ico-loader-rce-dos-ghsa-hff9-5pqw-6w9f#2026-10-30-a543469d",
      "url": "https://pwn.watch/i/imgproxy-ico-loader-rce-dos-ghsa-hff9-5pqw-6w9f#2026-10-30-a543469d",
      "title": "imgproxy ICO loader: unauthenticated integer overflow may allow RCE, plus heap OOB and memory-exhaustion DoS (GHSA-hff9-5pqw-6w9f / 494m / mmq5): imgproxy publishes GHSA-hff9-5pqw-6w9f (critical ICO loader integer overflow → DoS/possible RCE), GHSA-mmq5-xm89-9pfg (unbounded ICO data_size allocation DoS), and GHSA-494m-4556-wf5p (ICO BMP header OOB heap R/W DoS), fixed in v4.0.16 and v4.0.17.",
      "content_text": "imgproxy ICO loader: unauthenticated integer overflow may allow RCE, plus heap OOB and memory-exhaustion DoS (GHSA-hff9-5pqw-6w9f / 494m / mmq5): imgproxy publishes GHSA-hff9-5pqw-6w9f (critical ICO loader integer overflow → DoS/possible RCE), GHSA-mmq5-xm89-9pfg (unbounded ICO data_size allocation DoS), and GHSA-494m-4556-wf5p (ICO BMP header OOB heap R/W DoS), fixed in v4.0.16 and v4.0.17.\n\nSource: https://github.com/imgproxy/imgproxy/security/advisories/GHSA-hff9-5pqw-6w9f",
      "date_published": "2026-10-30T00:00:00.000Z",
      "external_url": "https://github.com/imgproxy/imgproxy/security/advisories/GHSA-hff9-5pqw-6w9f",
      "tags": [
        "critical"
      ]
    }
  ]
}