CVE-2026-25502

Katalog CVE

CVSS 7.8 · High EPSS 0,26%

Kerentanan Stack-based Buffer Overflow pada color iccdev. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, stack-based buffer overflow in icFixXml() function when processing malformed ICC profiles, allows potential arbitrary code execution through crafted NamedColor2 tags. This issue has been patched in version 2.3.1.2.

Rincian

Terbit di NVD

3 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-121: Stack-based Buffer Overflow
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/InternationalColorConsortium/iccDEV/issues/537 exploit · issue tracking · advisory vendor
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-c2qq-jf7w-rm27 patch · advisory vendor
• https://github.com/InternationalColorConsortium/iccDEV/commit/be5d7ec5cc137c084c08006aee8cd3ed378c7ac2 patch
• https://github.com/InternationalColorConsortium/iccDEV/pull/545 issue tracking · patch