CVE-2026-25502: iccDEV is vulnerable to stack-buffer-overflow in icFixXml()
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, stack-based buffer overflow in icFixXml() function when processing malformed ICC profiles, allows potential arbitrary code execution through crafted NamedColor2 tags. This issue has been patched in version 2.3.1.2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25502?
CVE-2026-25502 is classified as a critical vulnerability due to the potential for remote code execution caused by a stack-buffer overflow.
How do I fix CVE-2026-25502?
To remediate CVE-2026-25502, update iccDEV to version 2.3.1.2 or later.
What causes CVE-2026-25502?
CVE-2026-25502 is caused by a stack-buffer overflow in the icFixXml() function due to improper handling of malformed XML.
What software is affected by CVE-2026-25502?
CVE-2026-25502 affects iccDEV versions prior to 2.3.1.2.
Can CVE-2026-25502 be exploited remotely?
Yes, CVE-2026-25502 can be exploited remotely, allowing attackers to execute arbitrary code.