CVE-2026-25502: color iccdev Stack-based Buffer Overflow
Vulnerability summary
CVE-2026-25502 is a high (CVSS 7.8) Stack-based Buffer Overflow vulnerability in color iccdev. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 17% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 03-02-2026PublishedVulnerability first disclosed.
- 04-02-2026Last modifiedVulnerability information updated.
Description
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, stack-based buffer overflow in icFixXml() function when processing malformed ICC profiles, allows potential arbitrary code execution through crafted NamedColor2 tags. This issue has been patched in version 2.3.1.2.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
17%
Versus all other CVEs
30-day change
+0.06 pp
From 0.21% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundIccdev
Maturity: poc
Weaknesses
CWE · root cause- CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
2 vendors · 2 products
References
4 links- github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-c2qq-jf7w-rm27X Refsource CONFIRMPatchVendor Advisory
- github.com/InternationalColorConsortium/iccDEV/issues/537X Refsource MISCExploitIssue TrackingVendor Advisory