Iccdev CVE-2026-34536

CVSS 6.2 with local attack vector (AV:L), no privileges required (PR:N), and no user interaction (UI:N) indicates moderate severity with high availability impact (A:H). However, the attack is limited to local file processing-a remote attacker cannot directly trigger this without first delivering a malicious ICC profile through an application accepting untrusted profile uploads. The denial-of-service impact is significant but not critical; no confidentiality or integrity compromise occurs. Real-world risk depends heavily on deployment context: graphic design tools, image processing servers, or automated ICC profile validation pipelines face higher risk if they process untrusted profiles. The uncontrolled recursion flaw is a known architectural weakness; the low attack complexity means exploitation is straightforward once a malicious profile is crafted. This is a legitimate priority for applications processing user-supplied ICC profiles, but secondary for systems with strict input validation.

An attacker crafts a malicious ICC color profile containing deeply nested or cyclical calculator operations designed to trigger recursive calls in SIccCalcOp::ArgsUsed(). When a user opens this profile in a graphic design application or an automated image processing pipeline processes it via iccApplyProfiles, the stack overflows and the application crashes, resulting in denial of service. Attack complexity is low because the attacker simply needs to deliver the malicious profile file-no special privileges or user interaction beyond opening or processing the file is required.