CVE-2026-25585
Published: 04 February 2026
Summary
CVE-2026-25585 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Color Iccdev. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 1.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-25585 is an out-of-bounds read vulnerability in the iccDEV libraries and tools, which facilitate interaction, manipulation, and application of ICC color management profiles. The issue resides in IccCmm.cpp at line 5793, where improper array bounds validation occurs during ICC profile processing. A malformed ICC profile can trigger the flaw in the color management module, leading to memory disclosure or a segmentation fault from accessing memory beyond array boundaries. This affects iccDEV versions prior to 2.3.1.3 and is rated 7.8 on the CVSS 3.1 scale (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with associated CWEs including CWE-119, CWE-125, CWE-129, and CWE-787.
A local, unprivileged attacker can exploit this vulnerability by supplying a specially crafted, malformed ICC profile that a user processes through iccDEV. Exploitation requires low complexity and user interaction, such as opening the profile in an application leveraging iccDEV. Successful exploitation enables high-impact outcomes, including disclosure of sensitive memory contents, corruption of data (integrity violation), or system crashes via segmentation faults.
The vulnerability has been addressed in iccDEV version 2.3.1.3. Official mitigation guidance from the project's GitHub security advisory (GHSA-pmqx-q624-jg6w), issue tracker (#552), pull request (#563), and patching commit (ba81cd94b9c82b1d3905d45427badbd9d8adfa15) recommends upgrading to the fixed version to prevent improper bounds checking during profile indexing.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5317
Vulnerability details
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.3, there is a vulnerability IccCmm.cpp:5793 when reading through index during ICC profile processing. The malformed…
more
ICC profile triggers improper array bounds validation in the color management module, resulting in an out-of-bounds read that can lead to memory disclosure or segmentation fault from accessing memory beyond the array boundary. This issue has been patched in version 2.3.1.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds read/write in client-side ICC profile processing library enables memory disclosure, corruption, or crash when user opens crafted file; directly maps to client application exploitation for execution/impact.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires identifying, prioritizing, and remediating the out-of-bounds read flaw in iccDEV via patching to version 2.3.1.3, directly preventing exploitation.
Implements memory protection mechanisms such as bounds checking and address space protections that directly mitigate out-of-bounds reads leading to disclosure or crashes.
Mandates validation of ICC profile inputs to detect and reject malformed data causing improper array bounds validation during processing.