Description
imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction (vips_foreign_load_ico_header in vips/icoload.c) when an ICO entry declares a tiny data size, causing unvalidated header fields to be read and written past the allocated buffer. Unauthenticated remote attackers can supply a crafted ICO image to corrupt adjacent heap chunk metadata, triggering a glibc abort that crashes the worker.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| imgproxy | imgproxy | 3.3.0 – < 4.0.17 | 4.0.17 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/imgproxy/imgproxy | all versions | — | GO-2026-6895 |
| Go | github.com/imgproxy/imgproxy/v2 | all versions | — | GO-2026-6895 |
| Go | github.com/imgproxy/imgproxy/v3 | >= 3.3.0, < 4.0.17 | 4.0.17 | GHSA-494m-4556-wf5p |
| Go | github.com/imgproxy/imgproxy/v3 | >= 3.3.0 | — | GO-2026-6895 |
| Go | github.com/imgproxy/imgproxy/v4 | < 4.0.17 | 4.0.17 | GO-2026-6895 |
References
- GitHub Security Advisory (GHSA-494m-4556-wf5p) vendor-advisory
- VulnCheck Advisory: imgproxy before 4.0.17 Out-of-Bounds Write in ICO Loader third-party-advisory