Iccdev
CVE-2026-34533
MEDIUM
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionGitHub Advisory
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger Undefined Behavior (UB) in CIccCalculatorFunc::ApplySequence() due to invalid enum values being loaded for icChannelFuncSignature. The issue is observable under UBSan as a “load of value … not a valid value for type icChannelFuncSignature”, indicating a type/enum value confusion scenario during ICC profile processing. This issue has been patched in version 2.3.1.6.
AnalysisAI
Undefined Behavior in iccDEV prior to version 2.3.1.6 allows local attackers to cause a denial of service by supplying a crafted ICC color profile containing invalid enum values for icChannelFuncSignature, which triggers an application crash during profile processing in CIccCalculatorFunc::ApplySequence(). The vulnerability requires local file access or the ability to provide a malicious ICC profile to an application using the library; no public exploit code has been identified.
Technical ContextAI
iccDEV is a library for parsing and processing ICC (International Color Consortium) color management profiles, which are binary files that define color spaces and transformations. The vulnerability exists in the CIccCalculatorFunc::ApplySequence() function, which loads and interprets enum values designated as icChannelFuncSignature during profile processing. When a crafted profile contains an out-of-range enum value that does not map to any valid icChannelFuncSignature constant, the C++ runtime encounters Undefined Behavior-specifically a type/enum value confusion-as detected by UBSan (Undefined Behavior Sanitizer). The root cause is insufficient validation of enum values read from untrusted ICC profile data (CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior), leading to memory safety violations that manifest as denial of service.
RemediationAI
Upgrade iccDEV to version 2.3.1.6 or later, which patches the enum validation issue in CIccCalculatorFunc::ApplySequence(). For applications using iccDEV, rebuild and redeploy with the patched library version. Users unable to immediately upgrade should implement input validation at the application layer to reject ICC profiles from untrusted sources or sanitize profile data before passing it to iccDEV processing functions. See the GitHub security advisory at https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-8jj3-77m7-c3pq and patch PR #681 at https://github.com/InternationalColorConsortium/iccDEV/pull/681 for technical details.
iccDEV ICC color profile library (through 2.3.1) has a use-after-free in CIccXform::Create() when processing hint object
Heap buffer overflow in iccDEV versions 2.3.1.1 and below allows remote code execution through maliciously crafted ICC c
Heap buffer overflow in iccDEV versions 2.3.1.1 and below allows remote code execution when processing maliciously craft
Heap buffer overflow in iccDEV versions 2.3.1.1 and earlier allows remote code execution through maliciously crafted ICC
Type confusion in iccDEV library versions before 2.3.1.2 allows unauthenticated attackers to achieve remote code executi
iccDEV color management library versions 2.3.1 and earlier contain undefined behavior in the CLUT initialization functio
iccDEV ICC color profile libraries versions 2.3.1.1 and earlier suffer from undefined behavior and out-of-memory errors
Heap buffer overflow in iccDEV versions before 2.3.1.2 allows remote code execution when processing malicious ICC color
Type confusion in iccDEV versions before 2.3.1.2 allows attackers to corrupt memory and achieve high-impact outcomes inc
Type confusion in iccDEV versions before 2.3.1.2 allows unauthenticated attackers to achieve remote code execution throu
Heap buffer overflow in iccDEV versions before 2.3.1.2 allows remote code execution when processing malicious ICC color
Heap buffer overflow in iccDEV versions prior to 2.3.1.2 allows remote attackers to execute arbitrary code through the C
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today