imgproxy ICO loader integer overflow: heap overflow in image processing allows DoS/RCE (no CVE)
Severity: critical · Patch status: patched · Since 2026-10-30
imgproxy's ICO loader (vips/icoload.c) allocates datasize + BMPFILEHEADERLEN bytes using a 32-bit attacker-controlled datasize from a crafted ICO file. When datasize exceeds UINT32MAX - 14, the addition wraps (e.g. 0xfffffff5 + 14 = 3), producing a 3-byte allocation while the loader writes the ICO prefix and reads up to the original multi-gigabyte declared size 14 bytes into the undersized buffer, corrupting the heap. Any network client who can submit images to an imgproxy instance can trigger remote denial of service or potentially remote code execution. All versions = 4.0.0 prior to 4.0.16 are affected across the imgproxy module paths. Fixed in imgproxy 4.0.16 (commit a821b6a); no known exploitation in the wild.
What to do
- Upgrade imgproxy to 4.0.16 immediately
- Restrict which clients can submit images to imgproxy until patched
- Consider disabling ICO processing or filtering ICO uploads at the edge as a mitigation
- Monitor imgproxy worker processes for crashes or unexplained terminations
Fixed versions
Sources
All live incidents on Threat Watch
