What is the CVSS score of CVE-2026-27692?

CVE-2026-27692 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Iccdev are affected by CVE-2026-27692?

A HIGH severity vulnerability (CVE-2026-27692) affects iccDEV color management libraries used in image processing workflows.. A patch is available.

Is there a public PoC exploit available for CVE-2026-27692?

Yes, a public proof-of-concept exploit is available for CVE-2026-27692. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-27692?

Within 24 hours: Inventory all systems using iccDEV libraries and assess exposure scope. Within 7 days: Apply vendor patch to all affected systems and validate deployment through testing environments first. Within 30 days: Conduct post-patch verification, review access logs for exploitation attempts, and document remediation completion.

Iccdev CVE-2026-27692

HIGH

Out-of-bounds Read (CWE-125)

2026-02-25 security-advisories@github.com

Denial Of Service Iccdev

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 26, 2026 - 15:43 vuln.today

Public exploit code

Patch released

Feb 26, 2026 - 15:43 nvd

Patch available

CVE Published

Feb 25, 2026 - 15:20 nvd

HIGH 7.1

DescriptionGitHub Advisory

iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, heap-buffer-overflow read occurs during CIccTagTextDescription::Release() when strlen() reads past a heap buffer while parsing ICC profile XML text description tags, causing a crash. Commit 29d088840b962a7cdd35993dfabc2cb35a049847 fixes the issue. No known workarounds are available.

AnalysisAI

iccDEV provides a set of libraries and tools for working with ICC color management profiles. [CVSS 7.1 HIGH]

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Open malicious ICC profile file

Exploit

Parse XML text description tag

Execution

strlen() reads past heap buffer

Impact

Crash or information disclosure