CVE-2013-4988: IcoFX stack buffer overflow via crafted ICO idCount field

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityPublic exploit code exists and EPSS is very high, but exploitation requires a user to open a crafted ICO file and the product is a desktop image editor rather than a network service.

What it is

IcoFX 2.5 and earlier contains a stack-based buffer overflow triggered by a long idCount value in the ICONDIR structure of an ICO file. Opening a malicious icon file can corrupt the stack and allow code execution in the context of the user running IcoFX. The record notes some details come from third-party information, and no fixed version is stated.

Impact

An attacker who gets a crafted ICO file opened gains arbitrary code execution with the privileges of the IcoFX process, which can lead to full compromise of the user's session. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as complete.

Attack surface

The flaw is reached remotely by delivering a malicious ICO file that the victim opens in IcoFX; the AV:N/AC:M/Au:N vector indicates no authentication is required but some condition, such as user interaction to open the file, is needed. No network service exposure is described.

Exploitation

CISA KEV does not list this CVE, but EPSS is 0.66998 (99.263 percentile) and multiple references are tagged Exploit, including Exploit-DB and Packet Storm entries, so public exploit code exists.

What to do

• Upgrade IcoFX to a version later than 2.5 if the vendor provides one; the record does not name a fixed version, so verify with the vendor.
• If upgrade is not possible, avoid opening ICO files from untrusted or unsolicited sources.
• Block or quarantine ICO attachments at email and web gateways where feasible.
• Run IcoFX with least privilege and consider application sandboxing or AppContainer isolation.
• Monitor vendor advisories for IcoFX for a patched release.

Detection

• Hunt for IcoFX processes spawning child processes such as cmd.exe or powershell.exe, which would indicate successful exploitation.
• Monitor for IcoFX crashes or access violations in application event logs, especially after opening ICO files.
• Scan email and file transfer logs for ICO files delivered from external senders to users who run IcoFX.
• Use endpoint detection to flag stack corruption or ROP-like behavior in the IcoFX process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.