CVE-2026-25584

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.3, there is a stack-buffer-overflow vulnerability in CIccTagFloatNum<>::GetValues(). This is triggered when processing a malformed ICC profile. The vulnerability allows an out-of-bounds write on the stack, potentially leading to memory corruption, information disclosure, or code execution when processing specially crafted ICC files. This issue has been patched in version 2.3.1.3.

Published Feb 5, 2026

https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-xjr3-v3vr-5794

CVSS ScoreHigh

7.8

Ecosystem	Package	Version

Ecosystem	Package	Version

Vulnerabilities

CVE-2026-25584

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.3, there is a stack-buffer-overflow vulnerability in CIccTagFloatNum<>::GetValues(). This is triggered when processing a malformed ICC profile. The vulnerability allows an out-of-bounds write on the stack, potentially leading to memory corruption, information disclosure, or code execution when processing specially crafted ICC files. This issue has been patched in version 2.3.1.3.

Published Feb 5, 2026

https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-xjr3-v3vr-5794

CVSS ScoreHigh

7.8


npm	iccdev	2.2.120
npm	iccdev	2.2.121
npm	iccdev	2.2.122
npm	iccdev	2.2.123
npm	iccdev	2.2.124
npm	iccdev	2.2.125
npm	iccdev	2.2.126
npm	iccdev	2.2.128
npm	iccdev	2.2.129
npm	iccdev	2.2.131
npm	iccdev	2.2.132
npm	iccdev	2.2.133
npm	iccdev	2.2.134
npm	iccdev	2.2.135
npm	iccdev	2.2.136
npm	iccdev	2.2.137
npm	iccdev	2.2.138
npm	iccdev	2.2.139
npm	iccdev	2.2.140
npm	iccdev	2.2.141
npm	iccdev	2.2.142
npm	iccdev	2.2.143
npm	iccdev	2.2.144
npm	iccdev	2.2.145
npm	iccdev	2.2.146
npm	iccdev	2.2.147
npm	iccdev	2.2.148
npm	iccdev	2.2.149
npm	iccdev	2.2.150
npm	iccdev	2.2.151
npm	iccdev	2.2.152
npm	iccdev	2.2.153
npm	iccdev	2.2.154
npm	iccdev	2.2.61
npm	iccdev	2.3.1

Ecosystem	Package	Version


npm	iccdev	2.2.120
npm	iccdev	2.2.121
npm	iccdev	2.2.122
npm	iccdev	2.2.123
npm	iccdev	2.2.124
npm	iccdev	2.2.125
npm	iccdev	2.2.126
npm	iccdev	2.2.128
npm	iccdev	2.2.129
npm	iccdev	2.2.131
npm	iccdev	2.2.132
npm	iccdev	2.2.133
npm	iccdev	2.2.134
npm	iccdev	2.2.135
npm	iccdev	2.2.136
npm	iccdev	2.2.137
npm	iccdev	2.2.138
npm	iccdev	2.2.139
npm	iccdev	2.2.140
npm	iccdev	2.2.141
npm	iccdev	2.2.142
npm	iccdev	2.2.143
npm	iccdev	2.2.144
npm	iccdev	2.2.145
npm	iccdev	2.2.146
npm	iccdev	2.2.147
npm	iccdev	2.2.148
npm	iccdev	2.2.149
npm	iccdev	2.2.150
npm	iccdev	2.2.151
npm	iccdev	2.2.152
npm	iccdev	2.2.153
npm	iccdev	2.2.154
npm	iccdev	2.2.61
npm	iccdev	2.3.1

Find vulnerabilities. Fix fast with AI.

CVE-2026-25584

CVE-2026-25584