CVE-2026-25585
Out-of-Bounds Read in iccDEV ICC Profile Processing Causes Memory Disclosure
Publication date: 2026-02-04
Last updated on: 2026-02-18
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| color | iccdev | to 2.3.1.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-129 | The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array. |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in iccDEV's color management libraries prior to version 2.3.1.3. It occurs due to improper array bounds validation when processing ICC color profiles, specifically at IccCmm.cpp line 5793. A malformed ICC profile can trigger an out-of-bounds read, which means the software reads memory beyond the intended array limits.
This out-of-bounds read can lead to memory disclosure, where sensitive data might be exposed, or cause a segmentation fault, which crashes the program.
The issue has been fixed in version 2.3.1.3 of iccDEV.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to serious impacts including unauthorized disclosure of memory contents, which might contain sensitive information.
Additionally, it can cause the affected application to crash (segmentation fault), leading to denial of service.
The CVSS score of 7.8 indicates a high severity, meaning the vulnerability can significantly affect confidentiality, integrity, and availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the iccDEV libraries and tools to version 2.3.1.3 or later, where the issue has been patched.