CVE-2026-25503
Published: 03 February 2026
Summary
CVE-2026-25503 is a high-severity Incorrect Type Conversion or Cast (CWE-704) vulnerability in Color Iccdev. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 16.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Crafted ICC profile requires user interaction to load (T1204.002) and directly triggers application crash/DoS via type confusion (T1499.004).
NVD Description
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, type confusion allowed malformed ICC profiles to trigger undefined behavior when loading invalid icImageEncodingType values…
more
causing denial of service. This issue has been patched in version 2.3.1.2.
Deeper analysisAI
CVE-2026-25503 is a type confusion vulnerability (CWE-704, CWE-843) in iccDEV, a set of libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions prior to 2.3.1.2 are affected, where loading malformed ICC profiles containing invalid icImageEncodingType values triggers undefined behavior, resulting in denial of service.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H). Remote, unauthenticated attackers can exploit it by convincing users to load a specially crafted ICC profile, achieving high availability impact through denial of service and low integrity impact via the resulting undefined behavior.
The flaw was patched in iccDEV version 2.3.1.2. Security practitioners should update to this version for mitigation. Key resources include the GitHub security advisory (GHSA-pf84-4c7q-x764), the patching commit (353e6517a31cb6ac9fdd44ac0103bc2fadb25175), related issue #539, and pull request #547.
Details
- CWE(s)