{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/imgproxy/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["imgproxy (\u003e= 3.3.0, \u003c 4.0.17)"],"_cs_severities":["high"],"_cs_tags":["denial-of-service","heap-overflow","memory-corruption"],"_cs_type":"advisory","_cs_vendors":["imgproxy"],"content_html":"\u003cp\u003eimgproxy versions 3.3.0 through 4.0.15 contain an out-of-bounds heap write vulnerability in the ICO loader (\u003ccode\u003evips/icoload.c\u003c/code\u003e). When processing an ICO file with a small declared image data size, the loader performs OOB reads and writes while reconstructing the BMP header. This causes memory corruption in the heap, specifically overwriting the size field of adjacent heap chunks. This corruption leads to a glibc \u003ccode\u003emunmap_chunk()\u003c/code\u003e error, causing the Go worker to abort (SIGABRT) and exit (exit code 2).\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious ICO file containing a small \u003ccode\u003edata_size\u003c/code\u003e and specific header parameters.\u003c/li\u003e\n\u003cli\u003eAttacker sends an HTTP request to an exposed imgproxy endpoint to process the malicious ICO.\u003c/li\u003e\n\u003cli\u003eimgproxy passes the request to the underlying \u003ccode\u003evips\u003c/code\u003e library.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003evips_foreign_load_ico_header\u003c/code\u003e function allocates a small heap buffer based on the malicious \u003ccode\u003edata_size\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe loader performs OOB reads from the malformed header and performs OOB writes during BMP reconstruction.\u003c/li\u003e\n\u003cli\u003eThe size field of the following heap chunk is corrupted during the OOB write.\u003c/li\u003e\n\u003cli\u003eThe application invokes \u003ccode\u003efree()\u003c/code\u003e on the corrupted chunk.\u003c/li\u003e\n\u003cli\u003eThe glibc allocator detects the corruption and triggers \u003ccode\u003emunmap_chunk(): invalid pointer\u003c/code\u003e, leading to worker termination.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a persistent denial of service (DoS) for the specific worker process. Since a single request can trigger the abort, an attacker can crash workers at a rate proportional to the volume of requests sent to the vulnerable endpoint.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade to imgproxy version 4.0.17 or later to incorporate the patch for the ICO loader heap memory corruption.\u003c/li\u003e\n\u003cli\u003eImplement request size limits and file validation filters to block unknown or suspicious ICO files before they reach the processing layer.\u003c/li\u003e\n\u003cli\u003eDeploy monitoring for worker process exit codes; alert on high frequencies of exit code 2 in imgproxy worker pods.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-01T02:45:30Z","date_published":"2026-11-01T02:45:30Z","id":"https://feed.craftedsignal.io/briefs/2026-11-imgproxy-ico-crash/","summary":"An out-of-bounds heap write vulnerability in the imgproxy ICO loader allows unauthenticated attackers to trigger a deterministic worker crash (DoS) by supplying a crafted image file.","title":"imgproxy: Out-of-bounds heap write in ICO loader","url":"https://feed.craftedsignal.io/briefs/2026-11-imgproxy-ico-crash/"}],"language":"en","title":"CraftedSignal Threat Feed - Imgproxy","version":"https://jsonfeed.org/version/1.1"}