CVE-2026-25585 is a high-severity vulnerability in the InternationalColorConsortium's iccDEV library prior to version 2.3.1.3. It involves improper bounds checking during ICC profile processing, specifically in IccCmm.cpp at line 5793, leading to an out-of-bounds read. This flaw can cause memory disclosure or segmentation faults by accessing memory beyond allocated arrays. Exploitation requires a user to open or process a malformed ICC profile, with no privileges needed but user interaction required. The vulnerability impacts confidentiality, integrity, and availability due to potential memory corruption and data leakage. No known exploits are currently reported in the wild, and the issue has been patched in version 2.
CVE-2026-25584 is a high-severity stack-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.3. It occurs in the CIccTagFloatNum<>::GetValues() function when processing specially crafted ICC color profiles, allowing out-of-bounds writes on the stack. This can lead to memory corruption, potentially enabling information disclosure or arbitrary code execution. Exploitation requires local access and user interaction to process a malicious ICC file, but no privileges are needed. The vulnerability has been patched in version 2.3.1.
CVE-2026-25583 is a high-severity heap buffer overflow vulnerability in the iccDEV library, used for handling ICC color profiles. It occurs in the CIccFileIO::Read8() function when processing malformed ICC profile files due to an unchecked fread operation, leading to improper memory bounds restriction. The flaw affects versions prior to 2.3.1.3 and can be triggered by a local attacker with limited privileges and user interaction. Exploitation could result in complete compromise of confidentiality, integrity, and availability of affected systems. No known exploits are currently in the wild, but the vulnerability has been patched in version 2.3.1.
CVE-2026-25582 is a heap-based buffer overflow vulnerability in the iccDEV library used for ICC color profile manipulation. It occurs in the CIccIO::WriteUInt16Float() function when converting malformed XML to ICC profiles via the iccFromXml tool. The flaw affects versions prior to 2.3.1.3 and requires user interaction to trigger. Exploitation can lead to high impact on confidentiality, integrity, and availability, including potential remote code execution. The vulnerability has a CVSS score of 7.8 (high severity) and has been patched in version 2.3.
CVE-2026-25502 is a high-severity stack-based buffer overflow vulnerability in the icFixXml() function of the iccDEV library, used for handling ICC color profiles. It affects versions prior to 2.3.1.2 and can be triggered by processing specially crafted NamedColor2 tags in malformed ICC profiles. Exploitation requires local access and user interaction but can lead to arbitrary code execution, compromising confidentiality, integrity, and availability. No known exploits are currently in the wild. European organizations using iccDEV in image processing or color management workflows should prioritize updating to version 2.3.1.
CVE-2026-25503 is a high-severity vulnerability in iccDEV, a library used for handling ICC color management profiles. The flaw arises from incorrect type conversion or casting when processing malformed ICC profiles with invalid icImageEncodingType values. This type confusion leads to undefined behavior, specifically causing denial of service (DoS) by crashing the affected application. The vulnerability affects all iccDEV versions prior to 2.3.1.2 and requires user interaction to trigger, as it involves loading a crafted ICC profile. No known exploits are currently in the wild. The issue has been patched in version 2.3.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Versions prior to 2.3.1.2 have an undefined behavior issue when floating-point NaN values are converted to unsigned short integer types during ICC profile XML parsing potentially corrupting memory structures and enabling arbitrary code execution. This vulnerability affects users of the iccDEV library who process ICC color profiles. ICC Profile Injection vulnerabilities arise when user-controllable input is incorporated into ICC profile data or other structured binary blobs in an unsafe manner. Version 2.3.1.2 contains a fix for the issue. No known workarounds are available.
CVE-2026-24852 is a heap-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library prior to version 2.3.1.2. The flaw arises when the strlen() function reads a non-null-terminated buffer, potentially causing heap memory over-read, application crashes, and leakage of heap contents. This vulnerability affects applications processing ICC color profiles using vulnerable iccDEV versions. Exploitation requires user interaction and local access, with no known exploits in the wild. The vulnerability has a CVSS score of 6.1 (medium severity), impacting availability and confidentiality but not integrity. The issue is fixed in version 2.
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have aHeap Buffer Overflow vulnerability in the CIccTagXmlSegmentedCurve::ToXml() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior in CIccTagXmlSegmentedCurve::ToXml(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior and Null Pointer Deference in CIccProfileXml::ParseBasic(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior and Null Pointer Deference in CIccTagXmlFloatNum<>::ParseXml(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior in icSigCalcOp(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have a Heap Buffer Overflow vulnerability in CIccTagNamedColor2::SetSize(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have a Heap Buffer Overflow vulnerability in CIccMpeCalculator::Read(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In versions 2.3.1.1 and below, CIccXmlArrayType() contains a Null Pointer Dereference and Undefined Behavior vulnerability. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In versions 2.3.1.1 and below, an integer overflow vulnerability exists in icValidateStatus CIccProfile::CheckHeader() when user-controllable input is incorporated into profile data unsafely. Tampering with tag tables, offsets, or size fields can trigger parsing errors, memory corruption, or DoS, potentially enabling arbitrary Code Execution or bypassing application logic. This issue has been fixed in version 2.3.1.2.
CVE-2026-22861 is a high-severity heap-based buffer overflow vulnerability in the iccDEV library versions prior to 2.3.1.2, specifically in the SIccCalcOp::Describe() function within IccProfLib/IccMpeCalc.cpp. This vulnerability arises from unchecked return values leading to improper memory handling when processing ICC color profiles. Exploitation requires no privileges but does require user interaction, such as opening a crafted ICC profile. Successful exploitation can result in full confidentiality, integrity, and availability compromise, including potential remote code execution. The vulnerability affects any software or systems that utilize vulnerable versions of iccDEV for ICC profile processing. Although no known exploits are currently in the wild, the high CVSS score (8.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a heap-buffer-overflow vulnerability in `CIccCLUT::Init()` at `IccProfLib/IccTagLut.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a heap-buffer-overflow vulnerability in `SIccCalcOp::Describe()` at `IccProfLib/IccMpeCalc.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.