Tag
#image processing
imgproxy ICO Loader RCE, Fixed in 4.0.16 (GHSA-hff9-5pqw-6w9f)
imgproxy 4.0.0 to 4.0.15 allocates ICO data with a wrapping size that unauthenticated crafted-image requests turn into heap corruption; fixed in 4.0.16.
Oct 31, 2026