The vulnerability resides in when imgproxy reconstructs the BMP header of an ICO file; a tiny data size declared in the ICO entry causes unvalidated header fields to be accessed beyond the end of an allocated buffer. This out‑of‑bounds read and write corrupts adjacent heap metadata, leading glibc to abort the worker process. The result is a crash that can be repeated by repeatedly uploading crafted ICO images. The flaw is a classic out‑of‑bounds heap write, reflected by CWE‑787, and it carries a high severity CVSS score of 8.7.

The affected product is imgproxy by Evil Martians, specifically any version from 3.3.0 up to but not including 4.0.17. Users running those builds are vulnerable.

Unauthenticated remote attackers can supply a specially crafted ICO image to trigger the heap corruption; the exploitation requires no special privileges and can be executed from outside the network if the imgproxy instance accepts image uploads. Though the flaw currently only leads to a worker crash, a user could repeatedly induce a denial‑of‑service, exhausting resources. The EPSS metric is not available, but the high CVSS score indicates substantial risk. The vulnerability is not listed in CISA KEV, so no known fielded exploits have been reported yet, but the nature of the flaw warrants immediate attention.