CVE-2026-25502: 
Homebrew vulnerability analysis and mitigation

CVE-2026-25502 is a stack-based buffer overflow vulnerability in the icFixXml() function of iccDEV, a set of libraries and tools for interacting with ICC color management profiles maintained by the International Color Consortium. The flaw exists in all versions of iccDEV prior to 2.3.1.2 and is triggered when processing malformed ICC profiles containing crafted NamedColor2 tags. It was reported by researcher xsscx on January 27, 2026, and publicly disclosed on February 3, 2026, with a patch merged on January 28, 2026. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Feedly).

The root cause is a stack-based buffer overflow (CWE-121) and out-of-bounds write (CWE-787) in icFixXml() located at IccXML/IccLibXML/IccUtilXml.cpp, line 333. The vulnerability arises because the rootName field of a NamedColor2 tag entry is read from the ICC profile binary without ensuring null termination, allowing data to overflow the fixed-size fix stack buffer (256 bytes) when CIccTagXmlNamedColor2::ToXml() processes the tag. The attack vector is local and requires user interaction — specifically, a user must open or process a malicious ICC profile file (e.g., via the iccToXml command-line tool). The fix, applied in commit be5d7ec, adds a single line to enforce null termination: pNamedColor->rootName[sizeof(pNamedColor->rootName)-1] = 0; (GitHub Issue #537, GitHub Commit).

Successful exploitation can result in high impact to confidentiality, integrity, and availability of the affected system. An attacker who tricks a user into processing a crafted ICC profile can achieve arbitrary code execution with the privileges of the user running the iccDEV application, potentially enabling data theft, system compromise, or denial of service. Because iccDEV is a library used in image-processing pipelines, downstream applications that embed it may also be affected if they process untrusted ICC profiles (GitHub Advisory, Feedly).

A proof-of-concept (PoC) exploit in the form of a malicious ICC profile file is publicly available on GitHub, hosted by the original reporter (xsscx) at https://github.com/xsscx/fuzz/raw/refs/heads/master/graphics/icc/stack-buffer-overflow-icFixXml-CIccTagXmlNamedColor2-ToXml-IccUtilXml_cpp-Line333.icc. There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (very low probability of exploitation in the near term) (GitHub Issue #537, Feedly).

1. Craft or obtain a malicious ICC profile: Use the publicly available PoC file (stack-buffer-overflow-icFixXml-CIccTagXmlNamedColor2-ToXml-IccUtilXml_cpp-Line333.icc) from the reporter's GitHub repository, or craft a custom ICC profile with a NamedColor2 tag whose rootName field is not null-terminated and exceeds the expected buffer boundary.
2. Deliver the malicious file: Distribute the crafted ICC profile to a target user via email attachment, file share, or by embedding it in a document or image that triggers ICC profile processing.
3. Trigger processing: Induce the target user to open the file with an application that uses the vulnerable iccDEV library (e.g., running iccToXml malicious.icc output.xml or any application that calls CIccTagXmlNamedColor2::ToXml()).
4. Overflow the stack buffer: When icFixXml() processes the malformed NamedColor2 tag, the un-terminated rootName field causes a write of size 1 past the end of the 256-byte fix stack buffer at IccUtilXml.cpp:333, corrupting adjacent stack memory.
5. Achieve code execution: With a carefully crafted payload, the stack corruption can overwrite the return address or function pointer, redirecting execution to attacker-controlled code running with the privileges of the victim user (GitHub Issue #537, GitHub Advisory).

• File System: Presence of unexpected or externally sourced .icc profile files in user download directories, temp folders, or application data paths; specifically files with oversized or malformed NamedColor2 tag entries.
• Process: Abnormal termination (crash/abort) of iccToXml or any application embedding iccDEV when processing ICC files; AddressSanitizer output referencing icFixXml() at IccUtilXml.cpp:333 or CIccTagXmlNamedColor2::ToXml() at IccTagXml.cpp:691.
• Logs: Application crash logs or core dumps referencing stack corruption in icFixXml(), CIccTagXmlNamedColor2::ToXml(), or CIccProfileXml::ToXmlWithBlanks(); error messages such as AddressSanitizer: stack-buffer-overflow associated with ICC profile processing.
• Network: Unexpected outbound connections from image-processing services following ICC profile ingestion, which may indicate post-exploitation activity (GitHub Issue #537).

Upgrade iccDEV to version 2.3.1.2 or later, which includes the fix merged in commit be5d7ec on January 28, 2026. No official workarounds are provided by the vendor. As interim mitigations, administrators should restrict user access to untrusted ICC profile files, avoid processing ICC profiles from unverified external sources, and educate users not to open ICC files from unknown origins. Organizations using iccDEV as a dependency in downstream applications should audit and update their builds accordingly (GitHub Advisory, GitHub Commit).

The vulnerability was reported and triaged rapidly, with the fix merged within one day of the initial report (January 27–28, 2026) and the security advisory published on February 2, 2026. The reporter (xsscx) and maintainer (ChrisCoxArt) collaborated publicly on GitHub, and the issue was labeled as triaged and security-relevant by maintainers. Brief mentions appeared on social platforms including Mastodon and Bluesky via TheHackerWire shortly after disclosure, but no significant broader media coverage or notable researcher commentary beyond the immediate project community has been observed (GitHub Advisory, GitHub Pull Request #545).