imgproxy integer overflow in ICO loader

Severity: critical · CVSS 9.8 · Published 2026-10-30

imgproxy is an image processing service that converts and optimizes images on demand. An attacker who sends a specially crafted ICO image file can cause the service to crash (denial of service) or potentially execute arbitrary code on the server through heap memory corruption.

Technologies: github.com/imgproxy/imgproxy (Go), github.com/imgproxy/imgproxy/v2 (Go), github.com/imgproxy/imgproxy/v3 (Go), Imgproxy. Vendors: Go, Imgproxy.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Critical severity, with a CVSS score of 9.8, published 30 October 2026.
Which products and versions are affected?
github.com/imgproxy/imgproxy (Go) >= 4.0.0, < 4.0.16, SEMVER:introduced=4.0.0,fixed=4.0.16; github.com/imgproxy/imgproxy/v2 (Go) >= 4.0.0, < 4.0.16, SEMVER:introduced=4.0.0,fixed=4.0.16; github.com/imgproxy/imgproxy/v3 (Go) >= 4.0.0, < 4.0.16, SEMVER:introduced=4.0.0,fixed=4.0.16.
Is there a fix for This vulnerability?
Yes. github.com/imgproxy/imgproxy (Go): upgrade to 4.0.16 or later; github.com/imgproxy/imgproxy/v2 (Go): upgrade to 4.0.16 or later; github.com/imgproxy/imgproxy/v3 (Go): upgrade to 4.0.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network.
Am I affected?
Check whether you run github.com/imgproxy/imgproxy (Go), github.com/imgproxy/imgproxy/v2 (Go), github.com/imgproxy/imgproxy/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/imgproxy/imgproxy (Go): upgrade to 4.0.16 or later
    go get github.com/imgproxy/imgproxy@v4.0.16
  • github.com/imgproxy/imgproxy/v2 (Go): upgrade to 4.0.16 or later
    go get github.com/imgproxy/imgproxy/v2@v4.0.16
  • github.com/imgproxy/imgproxy/v3 (Go): upgrade to 4.0.16 or later
    go get github.com/imgproxy/imgproxy/v3@v4.0.16

Technical details

An integer overflow in the ICO file loader (vips/icoload.c) occurs when the attacker-controlled 32-bit data_size field is added to BMP_FILE_HEADER_LEN (14 bytes) before memory allocation. For data_size values greater than UINT32_MAX - 14, the addition wraps, causing a tiny allocation. The vulnerable code then writes the attacker's declared data size into this undersized buffer, corrupting the process heap.

Affected products

  • imgproxy imgproxy

Timeline

  • 2026-10-30: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.