CVE-2026-25584

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.3, there is a stack-buffer-overflow vulnerability in CIccTagFloatNum<>::GetValues(). This is triggered when processing a malformed ICC profile. The vulnerability allows an out-of-bounds write on the stack, potentially leading to memory corruption, information disclosure, or code execution when processing specially crafted ICC files. This issue has been patched in version 2.3.1.3.

• CWE-119
• CWE-121
• CWE-787
• CWE-788

• https://github.com/InternationalColorConsortium/iccDEV/commit/c9cb108f58683bd87afca616dea3e4cdb884c23fPatch
• https://github.com/InternationalColorConsortium/iccDEV/issues/551Exploit, Issue Tracking, Vendor Advisory
• https://github.com/InternationalColorConsortium/iccDEV/pull/565Patch
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-xjr3-v3vr-5794Vendor Advisory

Published

Feb 4, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25579Navidrome is an open source web-based music collection serve…6.5
• CVE-2026-2558A flaw has been found in GeekAI up to 4.2.4. The affected el…6.3
• CVE-2026-25580Pydantic AI is a Python agent framework for building applica…8.6
• CVE-2026-25581SCEditor is a lightweight WYSIWYG BBCode and XHTML editor. P…5.4
• CVE-2026-25582iccDEV provides a set of libraries and tools that allow for …7.8
• CVE-2026-25583iccDEV provides a set of libraries and tools that allow for …7.8
• CVE-2026-25585iccDEV provides a set of libraries and tools that allow for …7.8
• CVE-2026-25586SandboxJS is a JavaScript sandboxing library. Prior to 0.8.2…10
• CVE-2026-25587SandboxJS is a JavaScript sandboxing library. Prior to 0.8.2…10
• CVE-2026-25588RedisTimeSeries is a time-series module for Redis. In all ve…8.8
• CVE-2026-25589RedisBloom is a probabilistic data structures module for Red…8.8
• CVE-2026-2559The Post SMTP plugin for WordPress is vulnerable to unauthor…5.3