CVE-2026-25582-nvd.nist.gov-Received

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.…

Published:

3 February 2026 at 23:00:00

Alert date:

4 February 2026 at 23:02:35

Source:

nvd.nist.gov

Supply Chain & Dependencies

A heap buffer overflow vulnerability exists in iccDEV's CIccIO::WriteUInt16Float() function when converting malformed XML to ICC profiles using the iccFromXml tool. The vulnerability affects versions prior to 2.3.1.3 and has been patched in version 2.3.1.3. iccDEV provides libraries and tools for ICC color management profile interaction and manipulation. The vulnerability is triggered when processing malformed XML input during ICC profile conversion operations.

Technical details

Mitigation steps:

Affected products:

iccDEV