An integer overflow vulnerability exists in the ICO loader of imgproxy before version 4.0.16. The flaw occurs when a 32-bit attacker-controlled data size is added to a constant header length, causing an allocation size wraparound and resulting in a heap overflow. This can lead to denial of service or potentially remote code execution when processing a crafted ICO image.