Iccdev
CVE-2026-34535
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 6.2 score reflects a local attack vector (AV:L), low complexity (AC:L), no privilege requirement (PR:N), and impact limited to availability (A:H, no confidentiality or integrity impact). This aligns with a denial-of-service severity: the vulnerability crashes the application but does not enable code execution, memory disclosure, or privilege escalation. The absence of any authentication barrier (PR:N) means any local user can trigger the crash by placing a malicious ICC profile in a predictable location or passing it to vulnerable tools. However, the practical risk is moderate: exploitation requires user interaction (loading a profile into a vulnerable tool) and affects only availability, not data integrity. The confirmed patch (version 2.3.1.6) and narrow attack surface (ICC profile processing) further limit real-world impact compared to similar-scoring remote code execution vulnerabilities. No EPSS score, POC code, or KEV (CISA Known Exploited Vulnerabilities) listing is provided, indicating this is a lower-priority community report rather than an actively weaponized flaw. |
| Exploit ScenarioDerived | A local attacker crafts a malicious ICC color profile with oversized or malformed tag array definitions and saves it to a shared system location or email attachment. When a user or automated workflow processes this profile using iccRoundTrip or another iccDEV-based tool, the CIccTagArray::Cleanup() function attempts to deallocate heap memory with incorrect bounds, triggering a segmentation fault that crashes the application. This results in denial of service but does not grant code execution or data access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 31, 2026
Malformed ICC color profile files trigger a heap buffer overflow in iccDEV versions prior to 2.3.1.6, causing denial of service through segmentation fault in the CIccTagArray::Cleanup() function. Local attackers can exploit this vulnerability by crafting a malicious ICC profile that, when processed by iccRoundTrip or similar tools, crashes the application due to misaligned pointer access. No public exploit code has been identified, and this vulnerability is not confirmed as actively exploited in the wild.
RemediationAI
Vendor-released patch: iccDEV version 2.3.1.6 or later. Users should immediately upgrade to version 2.3.1.6, which includes fixes for the misaligned pointer access in CIccTagArray::Cleanup(). For organizations unable to upgrade immediately, restrict usage of iccDEV tools (particularly iccRoundTrip) to trusted ICC profile sources and avoid processing untrusted color profiles from unknown origins. The patch was merged in GitHub PR #683 and is publicly available. See https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-965q-9pp6-6vw5 for vendor advisory details.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
iccDEV is a standard library for reading, writing, and manipulating ICC color profiles, which are binary files used in color management across graphics applications. The vulnerability exists in the CIccTagArray::Cleanup() member function, where improper bounds checking on heap-allocated arrays permits out-of-bounds memory access. The root cause is a classic heap buffer overflow (CWE-122), specifically a misaligned member access vulnerability that manifests when UBSan/ASan instrumentation is enabled. The vulnerability occurs during the cleanup phase of tag array processing, suggesting the malicious profile exploits initialization or parsing logic that fails to validate array bounds before memory deallocation. ICC profiles are binary structures containing color transformation data; a crafted profile with oversized or malformed tag array definitions can cause the vulnerable code path to read or write beyond allocated heap memory.
Know when Iccdev gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger a segmentation fault (SEGV) in CIccTagArray::Cleanup(). The issue is observable under UBSan/ASan as misaligned member access / misaligned pointer loads followed by an invalid read leading to process crash when running iccRoundTrip on a malicious profile. This issue has been patched in version 2.3.1.6.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Affected Products (CPE)GitHub Advisory
iccDEV ICC color profile library (through 2.3.1) has a use-after-free in CIccXform::Create() when processing hint object
Heap buffer overflow in iccDEV versions 2.3.1.1 and below allows remote code execution through maliciously crafted ICC c
Heap buffer overflow in iccDEV versions 2.3.1.1 and below allows remote code execution when processing maliciously craft
Heap buffer overflow in iccDEV versions 2.3.1.1 and earlier allows remote code execution through maliciously crafted ICC
Type confusion in iccDEV library versions before 2.3.1.2 allows unauthenticated attackers to achieve remote code executi
iccDEV color management library versions 2.3.1 and earlier contain undefined behavior in the CLUT initialization functio
iccDEV ICC color profile libraries versions 2.3.1.1 and earlier suffer from undefined behavior and out-of-memory errors
Heap buffer overflow in iccDEV versions before 2.3.1.2 allows remote code execution when processing malicious ICC color
Type confusion in iccDEV versions before 2.3.1.2 allows attackers to corrupt memory and achieve high-impact outcomes inc
Type confusion in iccDEV versions before 2.3.1.2 allows unauthenticated attackers to achieve remote code execution throu
Heap buffer overflow in iccDEV versions before 2.3.1.2 allows remote code execution when processing malicious ICC color
Heap buffer overflow in iccDEV versions prior to 2.3.1.2 allows remote attackers to execute arbitrary code through the C
Exploit-DB