A crafted ICO image may cause an integer overflow in imgproxy’s ICO loader, leading to a heap buffer overflow. The overflow can corrupt heap memory, causing the process to crash or, depending on the attacker’s capability, to execute arbitrary code. The flaw is triggered by an inappropriate data_size value supplied in the ICO file, allowing attackers to control the memory allocation size in vips/icoload.c.

Versions of imgproxy from 4.0.0 up to but not including 4.0.16 are vulnerable. The affected product is imgproxy from Evil Martians, which processes image files on a remote host or within a distributed system.

The CVSS score of 9.3 indicates critical severity. While the EPSS score is not available, the high CVSS suggests that exploitation is feasible and could be widespread if attackers produce malicious ICO files. The vulnerability is not listed in CISA’s KEV catalog, but the remote nature of the attack means that any system exposed to externally supplied images is at risk. Attackers need only provide an ICO image to trigger the overflow, making the exploit straightforward to deploy.