# imgproxy ICO loader: unauthenticated integer overflow may allow RCE, plus heap OOB and memory-exhaustion DoS (GHSA-hff9-5pqw-6w9f / 494m / mmq5) · pwn.watch

> imgproxy's ICO loader (vips/icoload.c) has three related flaws reachable with a crafted image. GHSA-hff9-5pqw-6w9f is a critical unauthenticated integer overflow: an attacker-controlled 32-bit data_size wraps when BMP_FILE_HEADER_LEN is added, so the process allocates a few bytes then writes far past the buffer — GitHub rates it CVSS 3.1 9.8 and says the heap overflow can cause denial of service or remote code execution. GHSA-mmq5-xm89-9pfg (high, CVSS 7.5) passes the same data_size to VIPS_MALLOC without a bound, so a tiny ICO can force a multi-gigabyte allocation. GHSA-494m-4556-wf5p (high, CVSS 7.5) reconstructs a BMP header from unvalidated fields and can write out of bounds, crashing the worker. Fixed in v4.0.16 (overflow + unbounded alloc) and v4.0.17 (OOB heap R/W). Also tracked as GO-2026-6897, GO-2026-6898 and GO-2026-6895.

Page: https://pwn.watch/i/imgproxy-ico-loader-rce-dos-ghsa-hff9-5pqw-6w9f · generated 2026-11-06T02:47:11.166Z

## Status
- Severity: critical · status: live · patch: patched
- Product: imgproxy
- Started: 2026-10-30
- Affected: imgproxy >= 4.0.0, < 4.0.16 (integer overflow / unbounded alloc; also github.com/imgproxy/imgproxy{,/v2,/v3}); imgproxy >= 3.3.0, < 4.0.17 (OOB heap R/W in ICO BMP header reconstruction; GHSA-494m-4556-wf5p)
- Fixed in: imgproxy 4.0.16 (GHSA-hff9-5pqw-6w9f, GHSA-mmq5-xm89-9pfg); imgproxy 4.0.17 (GHSA-494m-4556-wf5p)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/imgproxy-ico-loader-rce-dos-ghsa-hff9-5pqw-6w9f/feed.xml
- JSON Feed: https://pwn.watch/i/imgproxy-ico-loader-rce-dos-ghsa-hff9-5pqw-6w9f/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/imgproxy-ico-loader-rce-dos-ghsa-hff9-5pqw-6w9f.json
- This file: https://pwn.watch/i/imgproxy-ico-loader-rce-dos-ghsa-hff9-5pqw-6w9f/llms.txt

## Updates (newest first)
- 2026-10-30: imgproxy publishes GHSA-hff9-5pqw-6w9f (critical ICO loader integer overflow → DoS/possible RCE), GHSA-mmq5-xm89-9pfg (unbounded ICO data_size allocation DoS), and GHSA-494m-4556-wf5p (ICO BMP header OOB heap R/W DoS), fixed in v4.0.16 and v4.0.17. (https://github.com/imgproxy/imgproxy/security/advisories/GHSA-hff9-5pqw-6w9f)

## Fix brief
# Security brief: imgproxy ICO loader: unauthenticated integer overflow may allow RCE, plus heap OOB and memory-exhaustion DoS (GHSA-hff9-5pqw-6w9f / 494m / mmq5)

Source: https://pwn.watch/i/imgproxy-ico-loader-rce-dos-ghsa-hff9-5pqw-6w9f · status: live · severity: critical · updated Nov 6, 2026, 00:20 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
imgproxy's ICO loader (vips/icoload.c) has three related flaws reachable with a crafted image. GHSA-hff9-5pqw-6w9f is a critical unauthenticated integer overflow: an attacker-controlled 32-bit data_size wraps when BMP_FILE_HEADER_LEN is added, so the process allocates a few bytes then writes far past the buffer — GitHub rates it CVSS 3.1 9.8 and says the heap overflow can cause denial of service or remote code execution. GHSA-mmq5-xm89-9pfg (high, CVSS 7.5) passes the same data_size to VIPS_MALLOC without a bound, so a tiny ICO can force a multi-gigabyte allocation. GHSA-494m-4556-wf5p (high, CVSS 7.5) reconstructs a BMP header from unvalidated fields and can write out of bounds, crashing the worker. Fixed in v4.0.16 (overflow + unbounded alloc) and v4.0.17 (OOB heap R/W). Also tracked as GO-2026-6897, GO-2026-6898 and GO-2026-6895.

Severity detail: GHSA-hff9-5pqw-6w9f Critical CVSS 3.1 9.8 (unauth integer overflow → possible RCE); sibling ICO-loader DoS advisories GHSA-mmq5-xm89-9pfg and GHSA-494m-4556-wf5p High CVSS 7.5

- Product: imgproxy

## Affected versions
- imgproxy >= 4.0.0, < 4.0.16 (integer overflow / unbounded alloc; also github.com/imgproxy/imgproxy{,/v2,/v3})
- imgproxy >= 3.3.0, < 4.0.17 (OOB heap R/W in ICO BMP header reconstruction; GHSA-494m-4556-wf5p)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- imgproxy 4.0.16 (GHSA-hff9-5pqw-6w9f, GHSA-mmq5-xm89-9pfg)
- imgproxy 4.0.17 (GHSA-494m-4556-wf5p)

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Specific notes
Upgrade imgproxy to 4.0.17 (covers all three ICO-loader advisories). 4.0.16 fixes the critical overflow and unbounded allocation; 4.0.17 fixes the OOB heap R/W. Anyone who can submit or cause imgproxy to fetch a crafted ICO can hit these unauthenticated.

## Latest updates
- Oct 30, 2026: imgproxy publishes GHSA-hff9-5pqw-6w9f (critical ICO loader integer overflow → DoS/possible RCE), GHSA-mmq5-xm89-9pfg (unbounded ICO data_size allocation DoS), and GHSA-494m-4556-wf5p (ICO BMP header OOB heap R/W DoS), fixed in v4.0.16 and v4.0.17.

## Advisories
- [GHSA-hff9-5pqw-6w9f: integer overflow in ICO loader (DoS / possible RCE)](https://github.com/imgproxy/imgproxy/security/advisories/GHSA-hff9-5pqw-6w9f) (imgproxy/imgproxy)
- [GHSA-hff9-5pqw-6w9f](https://github.com/advisories/GHSA-hff9-5pqw-6w9f) (GitHub Advisory Database)
- [GHSA-494m-4556-wf5p: OOB heap R/W in ICO loader BMP header reconstruction](https://github.com/imgproxy/imgproxy/security/advisories/GHSA-494m-4556-wf5p) (imgproxy/imgproxy)
- [GHSA-mmq5-xm89-9pfg: unbounded memory allocation in ICO loader](https://github.com/imgproxy/imgproxy/security/advisories/GHSA-mmq5-xm89-9pfg) (imgproxy/imgproxy)
- [GO-2026-6897 (maps to GHSA-hff9-5pqw-6w9f)](https://pkg.go.dev/vuln/GO-2026-6897) (Go vulnerability database)
- [GO-2026-6895 (maps to GHSA-494m-4556-wf5p)](https://pkg.go.dev/vuln/GO-2026-6895) (Go vulnerability database)
- [GO-2026-6898 (maps to GHSA-mmq5-xm89-9pfg)](https://pkg.go.dev/vuln/GO-2026-6898) (Go vulnerability database)
- [imgproxy v4.0.16 release](https://github.com/imgproxy/imgproxy/releases/tag/v4.0.16) (imgproxy/imgproxy)
- [imgproxy v4.0.17 release](https://github.com/imgproxy/imgproxy/releases/tag/v4.0.17) (imgproxy/imgproxy)
- [Fix commit a821b6a (v4.0.16)](https://github.com/imgproxy/imgproxy/commit/a821b6a4cb07a1bf2bb9077431d1c1e734d79917) (imgproxy/imgproxy)
- [Fix commit 39fd9e8 (v4.0.17)](https://github.com/imgproxy/imgproxy/commit/39fd9e844a8a46084161502e993d5a3c16ccf28d) (imgproxy/imgproxy)

---
Machine-readable: https://pwn.watch/i/imgproxy-ico-loader-rce-dos-ghsa-hff9-5pqw-6w9f.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.