What is the CVSS score of CVE-2026-25503?

CVE-2026-25503 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.0%.

Which versions of Iccdev are affected by CVE-2026-25503?

CVE-2026-25503 is a HIGH severity vulnerability affecting iccDEV color management libraries with a publicly available exploit, posing immediate risk to organizations using this software.. A patch is available.

Is there a public PoC exploit available for CVE-2026-25503?

Yes, a public proof-of-concept exploit is available for CVE-2026-25503. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25503?

Within 24 hours: Identify all systems and applications using iccDEV libraries and document their criticality. Within 7 days: Test and deploy available vendor patch to non-production environments. Within 30 days: Complete patch deployment across all production systems and verify patch installation.

Iccdev CVE-2026-25503

HIGH

Incorrect Type Conversion or Cast (CWE-704)

2026-02-03 security-advisories@github.com

Denial Of Service Iccdev

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 10, 2026 - 16:18 vuln.today

Public exploit code

Patch released

Feb 10, 2026 - 16:18 nvd

Patch available

CVE Published

Feb 03, 2026 - 19:16 nvd

HIGH 7.1

DescriptionGitHub Advisory

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, type confusion allowed malformed ICC profiles to trigger undefined behavior when loading invalid icImageEncodingType values causing denial of service. This issue has been patched in version 2.3.1.2.

AnalysisAI

Iccdev versions prior to 2.3.1.2 are vulnerable to denial of service when processing malformed ICC color profiles with invalid image encoding type values, causing application crashes due to type confusion. The vulnerability is remotely triggerable and public exploit code is available. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malformed ICC profile with invalid icImageEncodingType

Exploit

User opens profile in iccDEV application

Execution

Type confusion triggered in parser

Impact

Undefined behavior causes denial of service