An unbounded memory allocation occurs in the ICO loader of imgproxy when it processes the data_size field of an image header. A malicious actor can craft a 23‑byte ICO file that advertises a ~4GB data_size, causing the loader to request an excessive amount of memory and ultimately exhausting the worker process. The resulting crash leads to denial of service for all image processing requests handled by that worker. This flaw does not require authentication but can be exercised against any publicly accessible image proxy endpoint that accepts ICOs.

The vulnerability affects all imgproxy deployments running versions 3.3.0 through 4.0.15. Version 4.0.16 and later contain a fixed ICO loader that bounds the allocation.

The issue carries a CVSS score of 8.7, indicating a high severity. EPSS is not available, so the current exploitation likelihood is uncertain, but the vulnerability is not listed in the CISA KEV catalog. It is likely exploitable remotely via the public image service without specialized credentials, and an attacker can achieve total service disruption by repeatedly replaying crafted ICO files.