anonhaven

CVE-2026-25583

HIGH CVSS 3.1: 7.8 EPSS 0.25%
Updated Feb 05, 2026
iccDEV
Parameter Value
CVSS 7.8 (HIGH)
Fixed In 2.3.1.3
Type CWE-122 (Heap-based Buffer Overflow), CWE-119 (Buffer Overflow), CWE-787 (Out-of-bounds Write)
Vendor iccDEV
Public PoC No

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.3, there is a heap buffer overflow vulnerability in CIccFileIO::Read8() when processing malformed ICC profile files via unchecked fread operation. This issue has been patched in version 2.3.1.3.

Attack Parameters

Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
Required
User action required

Impact Assessment

Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service

CVSS Vector v3.1

Weakness Type (CWE)

CWE-122 Heap-based Buffer Overflow
CWE-119 Buffer Overflow
CWE-787 Out-of-bounds Write

References 4

https://github.com/InternationalColorConsortium/iccDEV/commit/8a6df2d8dac1e971a…
security-advisories@github.com
https://github.com/InternationalColorConsortium/iccDEV/issues/558
security-advisories@github.com
https://github.com/InternationalColorConsortium/iccDEV/pull/562
security-advisories@github.com
https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA…
security-advisories@github.com
Share Post Share Share Share