Context-dependent attackers were able to cause a denial of service via an ICO file with an InfoHeader containing a Height of zero (CVE-2007-3126).