Iccdev
CVE-2026-34534
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 score of 6.2 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H reflects a moderate-severity denial of service impact: local attack vector (AV:L) requires the attacker to place a malicious ICC profile on the target system, but low attack complexity (AC:L) and no privileges required (PR:N) make exploitation straightforward once file access is achieved. The vulnerability causes availability impact only (A:H), with no confidentiality or integrity compromise, limiting real-world damage to denial of service. No EPSS score, KEV status, or public exploit code confirmation is provided in the input data, suggesting this is not confirmed as actively exploited in the wild. However, the simplicity of the attack vector-placing a file and running a command-line tool-means exploitation is automatable and accessible to local users, developers, or CI/CD systems that process untrusted ICC profiles. The vulnerability primarily affects organizations that programmatically parse or validate ICC profiles from untrusted sources; end-users of image software are at lower risk unless workflows explicitly open externally-sourced profiles with tools like iccDumpProfile. Patch availability in a stable release (2.3.1.6) mitigates urgency but should still be prioritized for systems parsing external ICC profile inputs. |
| Exploit ScenarioDerived | An attacker crafts a malicious ICC color profile with oversized or out-of-bounds spectral matrix dimensions, then places it on a target system or submits it to a service that automatically processes ICC profiles (e.g., a cloud image conversion service, a CI/CD pipeline that validates color profiles, or a local developer's workstation). When iccDumpProfile or another iccDEV-based tool attempts to parse and describe the profile's spectral matrix data, the out-of-bounds heap read triggers a crash or memory corruption, resulting in denial of service. The attacker achieves this without authentication or user interaction on the target system, only requiring the ability to supply or place the malicious profile file where iccDEV tools will process it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 31, 2026
Heap buffer overflow in iccDEV prior to version 2.3.1.6 allows local attackers to trigger a denial of service via a malicious ICC color profile, causing out-of-bounds heap reads in the CIccMpeSpectralMatrix::Describe() function when processing profiles with iccDumpProfile. The vulnerability requires local file access but no user interaction or authentication, with confirmed patch availability in version 2.3.1.6.
RemediationAI
Update iccDEV to version 2.3.1.6 or later, which contains the patched CIccMpeSpectralMatrix::Describe() method with corrected bounds checking. For systems unable to update immediately, restrict access to the iccDumpProfile utility to trusted internal use only and avoid processing ICC profiles from untrusted or external sources. Developers integrating iccDEV should review GitHub issue #665 and pull request #682 (referenced in the official security advisory GHSA-7x9w-g476-wcc2) to understand the specific code fix and validate their dependency chains. Complete patch details and advisory information are available at https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-7x9w-g476-wcc2.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
iccDEV is a C++ library and toolset for parsing and manipulating ICC color management profiles, which are widely used in image processing workflows. The vulnerability stems from a heap buffer overflow (CWE-122: Heap-based Buffer Overflow) in the CIccMpeSpectralMatrix::Describe() method, specifically an out-of-bounds heap read triggered when processing spectral matrix data structures within a crafted ICC profile. ICC profiles are binary format files that can be embedded in images or distributed separately; the flaw manifests when the iccDumpProfile utility attempts to describe or parse the spectral matrix component of a malicious profile. The root cause is improper bounds checking on heap-allocated buffers used to store spectral matrix element data, allowing an attacker-controlled ICC profile to specify dimensions or offsets that exceed allocated memory regions.
Know when Iccdev gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger a heap-buffer-overflow (HBO) in CIccMpeSpectralMatrix::Describe(). The issue is observable under AddressSanitizer as an out-of-bounds heap read when running iccDumpProfile on a malicious profile. This issue has been patched in version 2.3.1.6.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Affected Products (CPE)GitHub Advisory
iccDEV ICC color profile library (through 2.3.1) has a use-after-free in CIccXform::Create() when processing hint object
Heap buffer overflow in iccDEV versions 2.3.1.1 and below allows remote code execution through maliciously crafted ICC c
Heap buffer overflow in iccDEV versions 2.3.1.1 and below allows remote code execution when processing maliciously craft
Heap buffer overflow in iccDEV versions 2.3.1.1 and earlier allows remote code execution through maliciously crafted ICC
Type confusion in iccDEV library versions before 2.3.1.2 allows unauthenticated attackers to achieve remote code executi
iccDEV color management library versions 2.3.1 and earlier contain undefined behavior in the CLUT initialization functio
iccDEV ICC color profile libraries versions 2.3.1.1 and earlier suffer from undefined behavior and out-of-memory errors
Heap buffer overflow in iccDEV versions before 2.3.1.2 allows remote code execution when processing malicious ICC color
Type confusion in iccDEV versions before 2.3.1.2 allows attackers to corrupt memory and achieve high-impact outcomes inc
Type confusion in iccDEV versions before 2.3.1.2 allows unauthenticated attackers to achieve remote code execution throu
Heap buffer overflow in iccDEV versions before 2.3.1.2 allows remote code execution when processing malicious ICC color
Heap buffer overflow in iccDEV versions prior to 2.3.1.2 allows remote attackers to execute arbitrary code through the C
Exploit-DB