A heap out-of-bounds write vulnerability exists in imgproxy's ICO loader affecting versions from 3.3.0 up to but not including 4.0.17. The flaw occurs during BMP header reconstruction when processing ICO images with a crafted small data buffer, causing heap corruption and a deterministic worker crash. This results in denial of service by terminating the worker handling the request.