CVE-2026-25583: 
Homebrew vulnerability analysis and mitigation

CVE-2026-25583 is a heap buffer overflow vulnerability in the iccDEV library's CIccFileIO::Read8() function, triggered when processing malformed ICC color profile files through an unchecked fread operation. It affects all iccDEV versions prior to 2.3.1.3 and was reported on January 31, 2026, with a patch merged on February 2, 2026, and the CVE published on February 4, 2026. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat CVE).

The root cause is an unchecked fread operation in CIccFileIO::Read8() at IccProfLib/IccIO.cpp:508, classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-122 (Heap-based Buffer Overflow), and CWE-787 (Out-of-bounds Write). When a malformed ICC profile file is parsed, the function reads data into a heap-allocated buffer without first validating that the tag size meets the minimum required size, allowing a write of up to 304 bytes past a 2-byte heap region. The fix, introduced in PR #562, adds a minimum size check in CIccTagUtf16Text::Read() before the fread call to prevent the underflow condition (GitHub Issue, Patch Commit).

Successful exploitation can result in high impact to confidentiality, integrity, and availability of the affected system. An attacker who tricks a user into processing a crafted ICC profile file could achieve arbitrary code execution in the context of the application using the iccDEV library, potentially enabling data theft, system compromise, or denial of service. Applications and pipelines that rely on iccDEV for ICC color profile processing — including image-processing tools and color management workflows — are at risk (GitHub Advisory, GitHub Issue).

A proof-of-concept (PoC) exploit consisting of two malformed ICC profile files is publicly available on GitHub, submitted by the original reporter (xsscx) as part of the bug report (GitHub Issue). Exploitation requires local access and user interaction (e.g., opening a malformed ICC profile), but no special privileges. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012%, reflecting low current exploitation probability (Red Hat CVE).

1. Craft or obtain malformed ICC profile files: Use the publicly available PoC files from the reporter's repository (e.g., heap-buffer-overflow-display-CIccFileIO-Read8-IccIO_cpp-Line508.icc and heap-buffer-overflow-observer-CIccFileIO-Read8-IccIO_cpp-Line508.icc) or craft custom malformed ICC profiles with manipulated tag size fields that underflow the minimum required size.
2. Deliver the malicious file: Convince a target user to open or process the malformed ICC profile file using an application built on a vulnerable version of iccDEV (prior to 2.3.1.3), for example via email attachment, file share, or a malicious download.
3. Trigger the vulnerable code path: When the application calls ReadIccProfile(), it invokes CIccProfile::Read() → CIccProfile::LoadTag() → CIccTagUtf16Text::Read() → CIccIO::Read16() → CIccFileIO::Read8() at IccIO.cpp:508, where fread writes beyond the allocated heap buffer.
4. Achieve heap corruption: The out-of-bounds write (up to 304 bytes past a 2-byte heap region) corrupts adjacent heap metadata or data structures, potentially enabling arbitrary code execution or causing a crash (denial of service) (GitHub Issue, GitHub Advisory).

• File System: Presence of unexpected or externally sourced .icc profile files in application working directories or temporary folders; malformed ICC files with anomalous tag size fields (e.g., tag size smaller than sizeof(icTagTypeSignature) + sizeof(icUInt32Number) + sizeof(icUChar16)).
• Process: Application crashes or abnormal termination when processing ICC profile files; AddressSanitizer (ASan) reports of heap-buffer-overflow in fread within CIccFileIO::Read8() at IccIO.cpp:508.
• Logs: Application error logs showing failures in CIccProfile::Read(), CIccProfile::LoadTag(), or CIccTagUtf16Text::Read() when processing specific ICC files; crash dumps referencing the iccV5DspObsToV4Dsp or similar iccDEV tools (GitHub Issue).

Upgrade iccDEV to version 2.3.1.3 or later, which includes the fix introduced in commit 8a6df2d via PR #562. The fix adds a minimum tag size validation in CIccTagUtf16Text::Read() before the fread call, preventing the heap overflow. As an interim workaround, restrict users from opening ICC profile files from untrusted or external sources until patching is complete. No other official workarounds have been provided by the vendor (GitHub Advisory, Patch Commit).