imgproxy ICO loader: unauthenticated integer overflow may allow RCE, plus heap OOB and memory-exhaustion DoS (GHSA-hff9-5pqw-6w9f / 494m / mmq5) · updates https://pwn.watch/i/imgproxy-ico-loader-rce-dos-ghsa-hff9-5pqw-6w9f imgproxy's ICO loader (vips/icoload.c) has three related flaws reachable with a crafted image. GHSA-hff9-5pqw-6w9f is a critical unauthenticated integer overflow: an attacker-controlled 32-bit data_size wraps when BMP_FILE_HEADER_LEN is added, so the process allocates a few bytes then writes far past the buffer — GitHub rates it CVSS 3.1 9.8 and says the heap overflow can cause denial of service or remote code execution. GHSA-mmq5-xm89-9pfg (high, CVSS 7.5) passes the same data_size to VIPS_MALLOC without a bound, so a tiny ICO can force a multi-gigabyte allocation. GHSA-494m-4556-wf5p (high, CVSS 7.5) reconstructs a BMP header from unvalidated fields and can write out of bounds, crashing the worker. Fixed in v4.0.16 (overflow + unbounded alloc) and v4.0.17 (OOB heap R/W). Also tracked as GO-2026-6897, GO-2026-6898 and GO-2026-6895. en Fri, 30 Oct 2026 00:00:00 GMT imgproxy ICO loader: unauthenticated integer overflow may allow RCE, plus heap OOB and memory-exhaustion DoS (GHSA-hff9-5pqw-6w9f / 494m / mmq5): imgproxy publishes GHSA-hff9-5pqw-6w9f (critical ICO loader integer overflow → DoS/possible RCE), GHSA-mmq5-xm89-9pfg (unbounded ICO data_size allocation DoS), and GHSA-494m-4556-wf5p (ICO BMP header OOB heap R/W DoS), fixed in v4.0.16 and v4.0.17. https://pwn.watch/i/imgproxy-ico-loader-rce-dos-ghsa-hff9-5pqw-6w9f https://pwn.watch/i/imgproxy-ico-loader-rce-dos-ghsa-hff9-5pqw-6w9f#2026-10-30-a543469d Fri, 30 Oct 2026 00:00:00 GMT critical <p><a href="https://github.com/imgproxy/imgproxy/security/advisories/GHSA-hff9-5pqw-6w9f">Source</a></p>