CVE-2026-25503: 
Homebrew vulnerability analysis and mitigation

CVE-2026-25503 is a type confusion vulnerability in iccDEV, a set of libraries and tools for interacting with ICC color management profiles maintained by the International Color Consortium. The flaw exists in CIccTagEmbeddedHeightImage::Validate() within IccProfLib/IccTagBasic.cpp (line 12084), where malformed ICC profiles can trigger undefined behavior by loading invalid icImageEncodingType values, causing denial of service. All versions prior to 2.3.1.2 are affected. The vulnerability was reported on January 27, 2026, patched on January 28, 2026, and publicly disclosed via GitHub Security Advisory GHSA-pf84-4c7q-x764 on February 2, 2026. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-704 (Incorrect Type Conversion or Cast) and CWE-843 (Access of Resource Using Incompatible Type / Type Confusion). The icImageEncodingType enum was originally defined without an explicit underlying type, meaning it could not safely hold arbitrary 32-bit values read from binary ICC profile files; the fix made the enum explicitly icUInt32Number (32-bit) to match binary file I/O. An attacker crafts a malformed ICC profile with an out-of-range icImageEncodingType value (e.g., 0x20000200 / 536871936), which when parsed by iccFromXml or any application using the vulnerable iccDEV library triggers UndefinedBehaviorSanitizer-detected undefined behavior. Exploitation requires user interaction — a user or application must open or process the malicious ICC profile — but no authentication or special privileges are needed (GitHub Issue #539, GitHub Advisory, Patch Commit).

The primary impact is denial of service through undefined behavior triggered during ICC profile parsing, with a secondary low-integrity impact due to potential manipulation of ICC tag tables, offsets, or size fields. In more severe scenarios, the advisory notes that vulnerable native libraries processing malformed profiles could potentially be leveraged for arbitrary code execution, though this has not been demonstrated in practice. Confidentiality is not directly impacted. Applications and pipelines that automatically process user-supplied ICC profiles (e.g., image editors, color management systems, print workflows) are most at risk (GitHub Advisory, GitHub Issue #539).

A proof-of-concept XML file (ub-runtime-error-type-confusion-IccTagBasic_cpp-Line12084.xml) is publicly available on GitHub and was used to reproduce the issue during triage. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.031% (0.000310), indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported (GitHub Issue #539, Feedly).

1. Craft malicious ICC profile: Create or obtain a malformed ICC profile XML file containing an invalid icImageEncodingType value (e.g., 0x20000200) in the embeddedHeightImageType tag. A public PoC XML file is available at https://raw.githubusercontent.com/xsscx/fuzz/refs/heads/master/xml/icc/ub-runtime-error-type-confusion-IccTagBasic_cpp-Line12084.xml.
2. Convert to binary ICC profile: Use the iccFromXml tool from a vulnerable iccDEV build (prior to 2.3.1.2) to convert the malicious XML to a binary .icc profile: iccFromXml ub-runtime-error-type-confusion-IccTagBasic_cpp-Line12084.xml malicious.icc.
3. Deliver to target: Distribute the malicious .icc file to a target user or system via email attachment, web download, or embedding in a document/image that triggers automatic ICC profile processing.
4. Trigger undefined behavior: When the target application (using vulnerable iccDEV) loads or validates the malicious profile, CIccTagEmbeddedHeightImage::Validate() at IccProfLib/IccTagBasic.cpp:12084 reads the invalid enum value, triggering undefined behavior and causing a denial of service crash (GitHub Issue #539, GitHub Advisory).

• File System: Presence of unexpected .icc or .xml files with malformed ICC profile structures, particularly those containing icImageEncodingType values outside the valid range (0x0000 for PNG, 0x0001 for TIFF); files matching the PoC filename ub-runtime-error-type-confusion-IccTagBasic_cpp-Line12084.xml or foo.icc.
• Logs: Application crash logs or core dumps originating from processes using iccDEV, particularly referencing IccProfLib/IccTagBasic.cpp:12084; UndefinedBehaviorSanitizer output containing runtime error: load of value ... which is not a valid value for type 'icImageEncodingType'.
• Process: Unexpected termination of image processing, color management, or print workflow applications; processes invoking iccFromXml or iccDumpProfile against externally sourced ICC files (GitHub Issue #539).

Upgrade iccDEV to version 2.3.1.2 or later, which fixes the issue by explicitly declaring the icImageEncodingType enum with an icUInt32Number (32-bit) underlying type to safely handle all values read from binary ICC profiles. The fix was merged in PR #547 (commit 353e651) on January 28, 2026. No official workarounds are provided; as an interim measure, restrict processing of ICC profiles from untrusted or external sources and implement input validation at the application layer to reject profiles with unexpected tag types (Patch Commit, GitHub Advisory).

The vulnerability was reported by security researcher xsscx and remediated by ChrisCoxArt (a contributor to the International Color Consortium project) within one day of the initial report. The fix was reviewed and merged by the maintainer on January 28, 2026, and a formal GitHub Security Advisory was published on February 2, 2026. No broader media coverage or notable community commentary beyond the GitHub issue and advisory has been identified (GitHub Issue #539, GitHub PR #547).