Vulnerability · Published Feb 3, 2026 · Assigned by GitHub_M

CVE-2026-25503iccDEV Has Type Confusion in CIccTagEmbeddedHeightImage::Validate()

High 7.1

In plain English

A high-severity type confusion in iccDEV from InternationalColorConsortium. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.3%top 75.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, type confusion allowed malformed ICC profiles to trigger undefined behavior when loading invalid icImageEncodingType values causing denial of service. This issue has been patched in version 2.3.1.2.

Affected products (as reported)

Vendor	Product	Versions
InternationalColorConsortium	iccDEV	< 2.3.1.2

Weakness: CWE-704, CWE-843 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

References

https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-pf84-4c7q-x764 x_refsource_CONFIRM
https://github.com/InternationalColorConsortium/iccDEV/issues/539 x_refsource_MISC
https://github.com/InternationalColorConsortium/iccDEV/pull/547 x_refsource_MISC
https://github.com/InternationalColorConsortium/iccDEV/commit/353e6517a31cb6ac9fdd44ac0103bc2fadb25175 x_refsource_MISC