Cyber Posture

CVE-2026-25503

HighPublic PoC

Published: 03 February 2026

Published
03 February 2026
Modified
10 February 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
EPSS Score 0.0005 16.3th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-25503 is a high-severity Incorrect Type Conversion or Cast (CWE-704) vulnerability in Color Iccdev. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 16.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Malicious File (T1204.002) and 1 other technique.
Threat & Defense Details

MITRE ATT&CK Enterprise TechniquesAI

T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Crafted ICC profile requires user interaction to load (T1204.002) and directly triggers application crash/DoS via type confusion (T1499.004).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, type confusion allowed malformed ICC profiles to trigger undefined behavior when loading invalid icImageEncodingType values…

more

causing denial of service. This issue has been patched in version 2.3.1.2.

Deeper analysisAI

CVE-2026-25503 is a type confusion vulnerability (CWE-704, CWE-843) in iccDEV, a set of libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions prior to 2.3.1.2 are affected, where loading malformed ICC profiles containing invalid icImageEncodingType values triggers undefined behavior, resulting in denial of service.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H). Remote, unauthenticated attackers can exploit it by convincing users to load a specially crafted ICC profile, achieving high availability impact through denial of service and low integrity impact via the resulting undefined behavior.

The flaw was patched in iccDEV version 2.3.1.2. Security practitioners should update to this version for mitigation. Key resources include the GitHub security advisory (GHSA-pf84-4c7q-x764), the patching commit (353e6517a31cb6ac9fdd44ac0103bc2fadb25175), related issue #539, and pull request #547.

Details

CWE(s)

Affected Products

color
iccdev
≤ 2.3.1.2

CVEs Like This One

CVE-2026-21684Same product: Color Iccdev
CVE-2026-21491Same product: Color Iccdev
CVE-2026-21500Same product: Color Iccdev
CVE-2026-21681Same product: Color Iccdev
CVE-2026-21686Same product: Color Iccdev
CVE-2026-21685Same product: Color Iccdev
CVE-2026-31792Same product: Color Iccdev
CVE-2026-27692Same product: Color Iccdev
CVE-2026-24852Same product: Color Iccdev
CVE-2026-21680Same product: Color Iccdev

References