CVE-2026-25503

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-25503
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, type confusion allowed malformed ICC profiles to trigger undefined behavior when loading invalid icImageEncodingType values causing denial of service. This issue has been patched in version 2.3.1.2.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/InternationalColorConsortium/iccDEV/commit/353e6517a31cb6ac9fdd44ac0103bc2fadb25175 Patch
https://github.com/InternationalColorConsortium/iccDEV/issues/539 Exploit Issue Tracking Vendor Advisory
https://github.com/InternationalColorConsortium/iccDEV/pull/547 Issue Tracking
https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-pf84-4c7q-x764 Patch Vendor Advisory
https://github.com/InternationalColorConsortium/iccDEV/issues/539 Exploit Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*
History

10 Feb 2026, 16:18

Type Values Removed Values Added
References () https://github.com/InternationalColorConsortium/iccDEV/commit/353e6517a31cb6ac9fdd44ac0103bc2fadb25175 - () https://github.com/InternationalColorConsortium/iccDEV/commit/353e6517a31cb6ac9fdd44ac0103bc2fadb25175 - Patch
References () https://github.com/InternationalColorConsortium/iccDEV/issues/539 - () https://github.com/InternationalColorConsortium/iccDEV/issues/539 - Exploit, Issue Tracking, Vendor Advisory
References () https://github.com/InternationalColorConsortium/iccDEV/pull/547 - () https://github.com/InternationalColorConsortium/iccDEV/pull/547 - Issue Tracking
References () https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-pf84-4c7q-x764 - () https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-pf84-4c7q-x764 - Patch, Vendor Advisory
First Time Color
Color iccdev
CPE cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*

04 Feb 2026, 21:16

Type Values Removed Values Added
References () https://github.com/InternationalColorConsortium/iccDEV/issues/539 - () https://github.com/InternationalColorConsortium/iccDEV/issues/539 -

03 Feb 2026, 19:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-03 19:16

Updated : 2026-02-10 16:18

NVD link : CVE-2026-25503

Mitre link : CVE-2026-25503

CVE.ORG link : CVE-2026-25503

JSON object : View

Products Affected

color

  • iccdev
CWE
CWE-704

Incorrect Type Conversion or Cast

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')