CVE-2026-25503

Katalog CVE

CVSS 7.1 · High EPSS 0,51%

Kerentanan Incorrect Type Conversion or Cast pada color iccdev. Skor CVSS 3.1 7.1 (High) menurut github.com.

Deskripsi (NVD)

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, type confusion allowed malformed ICC profiles to trigger undefined behavior when loading invalid icImageEncodingType values causing denial of service. This issue has been patched in version 2.3.1.2.

Rincian

Terbit di NVD

3 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-704: Incorrect Type Conversion or Cast
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 42,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/InternationalColorConsortium/iccDEV/issues/539 exploit · issue tracking · advisory vendor
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-pf84-4c7q-x764 patch · advisory vendor
• https://github.com/InternationalColorConsortium/iccDEV/commit/353e6517a31cb6ac9fdd44ac0103bc2fadb25175 patch
• https://github.com/InternationalColorConsortium/iccDEV/pull/547 issue tracking