Vulnerability details

CVE-2026-25503

InternationalColorConsortium iccDEV

iccDEV Has Type Confusion in CIccTagEmbeddedHeightImage::Validate()

CVSS 3.1

7.1High

Official description

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, type confusion allowed malformed ICC profiles to trigger undefined behavior when loading invalid icImageEncodingType values causing denial of service. This issue has been patched in version 2.3.1.2.

CVSS scores

Score	Version	Source	Vector
7.1High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H`

Affected products

Vendor	Product	Versions	Source
InternationalColorConsortium	iccDEV	< 2.3.1.2	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-pf84-4c7q-x764 x_refsource_CONFIRM
https://github.com/InternationalColorConsortium/iccDEV/pull/547 x_refsource_MISC
https://github.com/InternationalColorConsortium/iccDEV/commit/353e6517a31cb6ac9fdd44ac0103bc2fadb25175 x_refsource_MISC
https://github.com/InternationalColorConsortium/iccDEV/issues/539 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-02-03
Last updated: 2026-02-04
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.31%

Probability of exploitation in 30 days

24%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-704
Incorrect Type Conversion or Cast
CWE-843
Access of Resource Using Incompatible Type ('Type Confusion')