CVE-2026-25503CWE-704CWE-843

iccDEV Has Type Confusion in CIccTagEmbeddedHeightImage::Validate()

High · published February 3, 2026

CVSS v3.1
7.1
EPSS
1%
Percentile
43.0
In the wild
Unconfirmed
What it is

⚡ Malformed ICC profiles can trigger chaos! A simple mistake with the wrong values can send your application spiraling into denial of service. 🌀 Think of it like a color printer that completely malfunctions when fed an incorrect type of paper — instead of producing beautiful art, it just jams and stops working altogether. 🎨 This vulnerability can lead to service downtime, disrupting users and potentially impacting your reputation. An attacker could exploit this to cause unexpected behavior, effectively denying service to legitimate users. This can be especially damaging in critical applications relying on stable color management!

Put simply

Think of it like a color printer that completely malfunctions when fed an incorrect type of paper — instead of producing beautiful art, it just jams and stops working altogether. 🎨 This type confusion vulnerability in iccDEV allows malformed ICC profiles to cause undefined behavior when loading invalid icImageEncodingType values, leading to denial of service.

What to do

This vulnerability can lead to service downtime, disrupting users and potentially impacting your reputation. An attacker could exploit this to cause unexpected behavior, effectively denying service to legitimate users. This can be especially damaging in critical applications relying on stable color management! Upgrade to version 2.3.1.2 immediately to patch this vulnerability. Review your applications to ensure they're not using outdated libraries that could expose you to this risk. It’s a smart move to keep your dependencies updated regularly! You've got this! By taking these steps, you're on your way to securing your application. 🛡️

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00514 · 43.0th percentile
Weaknesses
CWE-704 · Incorrect Type Conversion or Cast; CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')
Published
2026-02-03T18:36Z
EPSS history
Timeline
  • 03 FEB 18:36Z
    iccDEV Has Type Confusion in CIccTagEmbeddedHeightImage::Validate()
    cvelistv5