CVE-2026-25503: color iccdev Incorrect Type Conversion or Cast
Vulnerability summary
CVE-2026-25503 is a high (CVSS 7.1) Incorrect Type Conversion or Cast vulnerability in color iccdev. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.9% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 03-02-2026PublishedVulnerability first disclosed.
- 04-02-2026Last modifiedVulnerability information updated.
Description
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, type confusion allowed malformed ICC profiles to trigger undefined behavior when loading invalid icImageEncodingType values causing denial of service. This issue has been patched in version 2.3.1.2.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
EPSS trend
Probability
0.51%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
+0.25 pp
From 0.26% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundIccdev
Maturity: poc
Weaknesses
CWE · root cause- CWE-704Incorrect Type Conversion or CastThe product does not correctly convert an object, resource, or structure from one type to a different type.
- CWE-843Access of Resource Using Incompatible Type ('Type Confusion')The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Affected systems
2 vendors · 2 products
References
4 links- github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-pf84-4c7q-x764X Refsource CONFIRMPatchVendor Advisory
- github.com/InternationalColorConsortium/iccDEV/issues/539X Refsource MISCExploitIssue TrackingVendor Advisory