CVE-2026-25582

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.3, there is a heap buffer overflow (read) vulnerability in CIccIO::WriteUInt16Float() when converting malformed XML to ICC profiles via iccFromXml tool. This issue has been patched in version 2.3.1.3.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-122 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Feb 4, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-255837.8iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.CVE-2026-255847.8iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.CVE-2026-255857.8iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.CVE-2026-2558610.0SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty on a sandbox object,CVE-2026-2558710.0SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, as Map is in SAFE_PROTOYPES, it's prototype can be obtained via Map.prototype CVE-2026-255888.8RedisTimeSeries is a time-series module for Redis. In all versions before 1.12.14 of RedisTimeSeries, the module does not properly validate CVE-2026-255898.8RedisBloom is a probabilistic data structures module for Redis. In all versions of RedisBloom before 2.8.20, the module does not properly va CVE-2026-25595.3The Post SMTP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `handle_offic CVE-2026-255906.1The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, th CVE-2026-255916.5New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.10.8-alpha.10, a CVE-2026-255929.9Semantic Kernel is an SDK used to build, orchestrate, and deploy AI agents and multi-agent systems. Prior to 1.71.0, an Arbitrary File Write CVE-2026-255938.4OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use the Gateway WebSocket API to write config