CVE-2026-25582
📋 TL;DR
A heap buffer overflow vulnerability in iccDEV's CIccIO::WriteUInt16Float() function allows attackers to cause denial of service or potentially execute arbitrary code by providing malformed XML input to the iccFromXml tool. This affects all users of iccDEV libraries and tools prior to version 2.3.1.3 who process untrusted XML files for ICC profile conversion.
💻 Affected Systems
- iccDEV libraries and tools
📦 What is this software?
Iccdev by Color
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or persistent backdoor installation.
Likely Case
Application crash (denial of service) and potential memory corruption that could be leveraged for information disclosure.
If Mitigated
Limited to application crash if proper input validation and memory protections are in place.
🎯 Exploit Status
Exploitation requires crafting malformed XML files and convincing users to process them through iccFromXml or applications using vulnerable iccDEV libraries.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.1.3
Vendor Advisory: https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-46hq-fphp-jggf
Restart Required: No
Instructions:
1. Update iccDEV to version 2.3.1.3 or later. 2. Rebuild any applications using iccDEV libraries. 3. Replace existing iccFromXml binary with patched version.
🔧 Temporary Workarounds
Disable XML processing
linuxTemporarily disable or restrict use of iccFromXml tool and XML processing features in applications using iccDEV.
# Remove execute permissions from iccFromXml
chmod -x /usr/bin/iccFromXml
Input validation
allImplement strict XML validation before passing files to iccDEV libraries.
🧯 If You Can't Patch
- Implement strict file upload controls and only allow trusted XML sources
- Run iccDEV tools in sandboxed/containerized environments with limited privileges
🔍 How to Verify
Check if Vulnerable:
Check iccDEV version: iccFromXml --version or examine library files. If version is below 2.3.1.3, system is vulnerable.Check Version:
iccFromXml --version 2>&1 | grep -i versionVerify Fix Applied:
Confirm version is 2.3.1.3 or higher and test with known malformed XML samples to ensure no crashes occur.📡 Detection & Monitoring
Log Indicators:
- Application crashes of iccFromXml or processes using iccDEV libraries
- Segmentation fault errors in system logs
Network Indicators:
- Unusual file uploads to systems using iccDEV
- XML files with abnormal structure being processed
SIEM Query:
process_name:"iccFromXml" AND (event_type:"crash" OR exit_code:139)🔗 References
- https://github.com/InternationalColorConsortium/iccDEV/commit/b5e5dd238f609ec1a4efb25674e7fa4bd29d894a
- https://github.com/InternationalColorConsortium/iccDEV/issues/559
- https://github.com/InternationalColorConsortium/iccDEV/pull/561
- https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-46hq-fphp-jggf
