What is the CVSS score of CVE-2026-24404?

CVE-2026-24404 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.2%.

Which versions of Iccdev are affected by CVE-2026-24404?

A vulnerability in iccDEV color management libraries (versions 2.3.1.1 and below) could allow attackers to crash applications or potentially execute code through specially crafted ICC profiles.. A patch is available.

Is there a public PoC exploit available for CVE-2026-24404?

Yes, a public proof-of-concept exploit is available for CVE-2026-24404. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-24404?

Within 24 hours: Inventory all systems using iccDEV versions 2.3.1.1 or below and assess exposure to untrusted ICC profile inputs. Within 7 days: Deploy available patches to all affected systems; prioritize production environments and customer-facing services. Within 30 days: Complete patching across all environments including development and testing systems, and validate functionality post-update.

Iccdev CVE-2026-24404

HIGH

Improper Input Validation (CWE-20)

2026-01-24 security-advisories@github.com

Null Pointer Dereference Iccdev

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:59 vuln.today

PoC Detected

Jan 30, 2026 - 18:24 vuln.today

Public exploit code

Patch released

Jan 30, 2026 - 18:24 nvd

Patch available

CVE Published

Jan 24, 2026 - 01:15 nvd

HIGH 7.1

DescriptionGitHub Advisory

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In versions 2.3.1.1 and below, CIccXmlArrayType() contains a Null Pointer Dereference and Undefined Behavior vulnerability. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.

AnalysisAI

iccDEV versions 2.3.1.1 and below contain a null pointer dereference in the CIccXmlArrayType() function that allows remote attackers to trigger denial of service, data manipulation, or potentially achieve code execution through crafted ICC profile data. The vulnerability stems from unsafe handling of user-controlled input in binary structured data and has public exploit code available. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious ICC profile file

Delivery

Upload or supply profile to iccDEV application

Exploit

Trigger CIccXmlArrayType() parser

Execution

Null pointer dereference

Impact

Denial of service or data corruption