A vulnerability in imgproxy's ICO image loader allows unauthenticated attackers to trigger unbounded memory allocation by crafting a specially formed ICO file. The flaw exists because the ICO loader reads a data size field from the file without validation and uses it directly to allocate memory, potentially causing a ~4GB allocation from a small 23-byte file. This can lead to denial of service via memory exhaustion on affected imgproxy versions prior to 4.0.16.