CVE-2026-25503
Published: 03 February 2026
Summary
CVE-2026-25503 is a high-severity Incorrect Type Conversion or Cast (CWE-704) vulnerability in Color Iccdev. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 32.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-25503 is a type confusion vulnerability (CWE-704, CWE-843) in iccDEV, a set of libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions prior to 2.3.1.2 are affected, where loading malformed ICC profiles containing invalid icImageEncodingType values triggers undefined behavior, resulting in denial of service.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H). Remote, unauthenticated attackers can exploit it by convincing users to load a specially crafted ICC profile, achieving high availability impact through denial of service and low integrity impact via the resulting undefined behavior.
The flaw was patched in iccDEV version 2.3.1.2. Security practitioners should update to this version for mitigation. Key resources include the GitHub security advisory (GHSA-pf84-4c7q-x764), the patching commit (353e6517a31cb6ac9fdd44ac0103bc2fadb25175), related issue #539, and pull request #547.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5192
Vulnerability details
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, type confusion allowed malformed ICC profiles to trigger undefined behavior when loading invalid icImageEncodingType values…
more
causing denial of service. This issue has been patched in version 2.3.1.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Crafted ICC profile requires user interaction to load (T1204.002) and directly triggers application crash/DoS via type confusion (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires applying the vendor patch (v2.3.1.2) that eliminates the type-confusion flaw in ICC profile loading.
Mandates validation of untrusted input fields such as icImageEncodingType, blocking the malformed ICC profiles that trigger the vulnerability.
Requires memory-protection mechanisms that can contain or prevent exploitation of the undefined behavior resulting from the type confusion.