What is the CVSS score of CVE-2026-24407?

CVE-2026-24407 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.2%.

Which versions of Iccdev are affected by CVE-2026-24407?

A HIGH severity vulnerability in iccDEV color management libraries (CVE-2026-24407) affects versions 2.3.1.1 and below and has a public exploit available.. A patch is available.

Is there a public PoC exploit available for CVE-2026-24407?

Yes, a public proof-of-concept exploit is available for CVE-2026-24407. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-24407?

Within 24 hours: Inventory all systems running iccDEV versions 2.3.1.1 and below; isolate affected systems from critical workflows if patching cannot be completed immediately. Within 7 days: Apply available vendor patch to all affected installations; validate patch deployment across the environment. Within 30 days: Complete security testing and return systems to full production; document all patched systems in your asset management system.

Iccdev CVE-2026-24407

HIGH

Improper Input Validation (CWE-20)

2026-01-24 security-advisories@github.com

Denial Of Service RCE Code Injection Iccdev

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:59 vuln.today

PoC Detected

Jan 30, 2026 - 18:24 vuln.today

Public exploit code

Patch released

Jan 30, 2026 - 18:24 nvd

Patch available

CVE Published

Jan 24, 2026 - 01:15 nvd

HIGH 7.1

DescriptionGitHub Advisory

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior in icSigCalcOp(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.

AnalysisAI

iccDEV versions 2.3.1.1 and earlier allow remote attackers to trigger undefined behavior in the icSigCalcOp() function through malicious ICC color profiles, enabling denial of service, data manipulation, or potential code execution. The vulnerability stems from unsafe handling of user-controllable input in binary profile data, and public exploit code exists. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious ICC profile with invalid icSigCalcOp data

Exploit

User opens profile in vulnerable iccDEV application

Execution

Trigger undefined behavior in parser

Impact

Cause denial of service or data corruption