CVE ID: CVE-2026-25582 Severity: High (7.8/10) Package: iccDEV Affected Versions: <2.3.1.2 Patched Versions: 2.3.1.3 Description: - Summary: Heap buffer overflow in CIccIO::WriteUInt16Float when converting malformed XML to ICC profiles via iccFromXml tool. - Impact: Affects users of the iccDEV library processing ICC color profiles. ICC Profile Injection vulnerabilities occur with unsafe user-controllable input incorporated into ICC profile data. - Detail: Possible manipulation of ICC tag tables, parsing errors, bypassing application logic, and potentially arbitrary code execution. - References: Issue #559, PR #561 - Workarounds: Not Provided Severity Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Confidentiality, Integrity, Availability: High Weaknesses: CWE-119, CWE-122, CWE-787 Credits: ChrisCoxArt (Remediation Developer), XSSCX (Reporter)