What is the CVSS score of CVE-2026-24410?

CVE-2026-24410 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.2%.

Which versions of Iccdev are affected by CVE-2026-24410?

A high-severity vulnerability in iccDEV color management libraries (CVE-2026-24410) could allow attackers to crash applications or potentially execute code through malformed ICC profile files.. A patch is available.

Is there a public PoC exploit available for CVE-2026-24410?

Yes, a public proof-of-concept exploit is available for CVE-2026-24410. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-24410?

Within 24 hours: Identify all systems and applications using iccDEV versions 2.3.1.1 or below and assess business criticality. Within 7 days: Apply available patches to non-critical systems and conduct testing in staging environments. Within 30 days: Complete patch deployment across all production systems and verify no vulnerable versions remain in use.

Iccdev CVE-2026-24410

HIGH

Improper Input Validation (CWE-20)

2026-01-24 security-advisories@github.com

Null Pointer Dereference Iccdev

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:59 vuln.today

PoC Detected

Jan 30, 2026 - 18:24 vuln.today

Public exploit code

Patch released

Jan 30, 2026 - 18:24 nvd

Patch available

CVE Published

Jan 24, 2026 - 02:15 nvd

HIGH 7.1

DescriptionGitHub Advisory

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior and Null Pointer Deference in CIccProfileXml::ParseBasic(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.

AnalysisAI

iccDEV versions 2.3.1.1 and below are vulnerable to null pointer dereference in CIccProfileXml::ParseBasic() when processing maliciously crafted ICC color profiles, allowing remote attackers to trigger denial of service or data manipulation without user interaction. Public exploit code exists for this vulnerability, which affects applications using the iccDEV libraries for color profile handling. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious ICC profile file

Delivery

User opens profile in iccDEV application

Exploit

ParseBasic() processes null pointer

Execution

Trigger undefined behavior

Impact

Denial of service or data manipulation