Iccdev
CVE-2026-34536
MEDIUM
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger a stack overflow (SO) in SIccCalcOp::ArgsUsed(). The issue is observable under AddressSanitizer as a stack-overflow when iccApplyProfiles processes a malicious profile, with the crash occurring while computing argument usage during calculator underflow/overflow checks. This issue has been patched in version 2.3.1.6.
AnalysisAI
Stack overflow in iccDEV's SIccCalcOp::ArgsUsed() function allows local attackers to trigger a denial of service by supplying a crafted ICC color profile to iccApplyProfiles. The vulnerability affects iccDEV versions prior to 2.3.1.6 and requires no authentication or user interaction; exploitation manifests as application crash during calculator argument computation. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
iccDEV is a C++ library implementing ICC color profile management, used for reading and processing color management data in imaging workflows. The vulnerability exists in the SIccCalcOp::ArgsUsed() function, which is called during stack-based calculator evaluation when processing ICC profile data. The root cause (CWE-674: Uncontrolled Recursion) indicates the function does not properly limit recursive depth or stack usage when parsing maliciously crafted profile structures. When iccApplyProfiles processes an ICC profile containing specially crafted calculator operations, the recursive call chain in ArgsUsed() exhausts the stack without proper bounds checking, leading to stack overflow. The local attack vector and low attack complexity suggest the attacker simply needs to provide a malicious ICC file to an application using iccDEV.
RemediationAI
Vendor-released patch: iccDEV version 2.3.1.6 or later. Applications using iccDEV should update their dependencies to the patched version immediately. Users unable to upgrade should implement input validation on ICC profile files, rejecting profiles from untrusted sources or those with suspicious calculator operation structures. The fix is available in the official repository (https://github.com/InternationalColorConsortium/iccDEV/pull/684). Additional defense-in-depth measures include running ICC profile processing in a sandboxed environment or with resource limits (stack size limits via ulimit) to prevent complete system impact.
iccDEV ICC color profile library (through 2.3.1) has a use-after-free in CIccXform::Create() when processing hint object
Heap buffer overflow in iccDEV versions 2.3.1.1 and below allows remote code execution through maliciously crafted ICC c
Heap buffer overflow in iccDEV versions 2.3.1.1 and below allows remote code execution when processing maliciously craft
Heap buffer overflow in iccDEV versions 2.3.1.1 and earlier allows remote code execution through maliciously crafted ICC
Type confusion in iccDEV library versions before 2.3.1.2 allows unauthenticated attackers to achieve remote code executi
iccDEV color management library versions 2.3.1 and earlier contain undefined behavior in the CLUT initialization functio
iccDEV ICC color profile libraries versions 2.3.1.1 and earlier suffer from undefined behavior and out-of-memory errors
Heap buffer overflow in iccDEV versions before 2.3.1.2 allows remote code execution when processing malicious ICC color
Type confusion in iccDEV versions before 2.3.1.2 allows attackers to corrupt memory and achieve high-impact outcomes inc
Type confusion in iccDEV versions before 2.3.1.2 allows unauthenticated attackers to achieve remote code execution throu
Heap buffer overflow in iccDEV versions before 2.3.1.2 allows remote code execution when processing malicious ICC color
Heap buffer overflow in iccDEV versions prior to 2.3.1.2 allows remote attackers to execute arbitrary code through the C
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today