What is the CVSS score of CVE-2026-24411?

CVE-2026-24411 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.2%.

Which versions of Iccdev are affected by CVE-2026-24411?

A high-severity vulnerability (CVE-2026-24411) in iccDEV color management libraries affects systems using versions 2.3.1.1 and below.. A patch is available.

Is there a public PoC exploit available for CVE-2026-24411?

Yes, a public proof-of-concept exploit is available for CVE-2026-24411. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-24411?

Within 24 hours: Identify all systems and applications using iccDEV versions 2.3.1.1 or below and restrict access where possible. Within 7 days: Apply the available vendor patch to all affected systems, prioritizing production environments and customer-facing services. Within 30 days: Verify patch deployment across the entire infrastructure and validate that no legacy or isolated systems remain unpatched.

Iccdev CVE-2026-24411

HIGH

Improper Input Validation (CWE-20)

2026-01-24 security-advisories@github.com

Denial Of Service RCE Code Injection Iccdev

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:59 vuln.today

PoC Detected

Jan 30, 2026 - 18:25 vuln.today

Public exploit code

Patch released

Jan 30, 2026 - 18:25 nvd

Patch available

CVE Published

Jan 24, 2026 - 02:15 nvd

HIGH 7.1

DescriptionGitHub Advisory

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior in CIccTagXmlSegmentedCurve::ToXml(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.

AnalysisAI

iccDEV versions 2.3.1.1 and earlier contain unsafe handling of user-supplied input in the CIccTagXmlSegmentedCurve::ToXml() function, enabling remote attackers to trigger undefined behavior in ICC profile parsing. Public exploit code exists for this vulnerability, which can lead to denial of service, data manipulation, or arbitrary code execution. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker crafts malicious ICC profile

Exploit

User opens profile in vulnerable iccDEV application

Execution

Undefined behavior triggered in CIccTagXmlSegmentedCurve::ToXml()

Impact

Data corruption or denial of service occurs