Vulnerability · Published Feb 3, 2026 · Assigned by GitHub_M

CVE-2026-25502iccDEV is vulnerable to stack-buffer-overflow in icFixXml()

High 7.8

In plain English

A high-severity stack buffer overflow in iccDEV from InternationalColorConsortium. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 84.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, stack-based buffer overflow in icFixXml() function when processing malformed ICC profiles, allows potential arbitrary code execution through crafted NamedColor2 tags. This issue has been patched in version 2.3.1.2.

Affected products (as reported)

Vendor	Product	Versions
InternationalColorConsortium	iccDEV	< 2.3.1.2

Weakness: CWE-121, CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-c2qq-jf7w-rm27 x_refsource_CONFIRM
https://github.com/InternationalColorConsortium/iccDEV/issues/537 x_refsource_MISC
https://github.com/InternationalColorConsortium/iccDEV/pull/545 x_refsource_MISC
https://github.com/InternationalColorConsortium/iccDEV/commit/be5d7ec5cc137c084c08006aee8cd3ed378c7ac2 x_refsource_MISC