GitHub Advisory Database8 days ago
imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution
Summary The ICO loader allocates data_size + BMP_FILE_HEADER_LEN bytes after reading a 32-bit attacker-controlled data_size. For data_size > UINT32_MAX - BMP_FILE_HEADER_LEN, the addition wraps before allocation. imgproxy then writes the ICO prefix and reads up to the original de
Published October 30, 2026 · 10:57 PM
Summary The ICO loader allocates data_size + BMP_FILE_HEADER_LEN bytes after reading a 32-bit attacker-controlled data_size. For data_size > UINT32_MAX - BMP_FILE_HEADER_LEN, the addition wraps before allocation. imgproxy then writes the ICO prefix and reads up to the original de
Source: GitHub Advisory Database
Ask AI about this articleBeta
The AI only has access to this article — it won't make up facts. Try:
Supporting evidence0 items
Community check0 comments
No votes yet
0% real0% fake