Iccdev CVE-2026-34537

CVSS 6.2 reflects a local attack vector (AV:L), low complexity (AC:L), no privilege requirement (PR:N), and no user interaction (UI:N), with availability impact (A:H) but no confidentiality or integrity impact. The local-only attack vector significantly reduces real-world risk compared to a remote vector, as it requires the attacker to already have file system access or trick a user into processing a malicious profile locally. The undefined behavior nature means exploitation outcomes are compiler and runtime dependent-some builds may crash cleanly, others may exhibit memory corruption or be mitigated by compiler hardening. KEV status is not active (no CISA confirmation of in-the-wild exploitation), and no publicly available exploit code has been identified, lowering the immediate threat level. However, the attack is deterministic for triggering crashes in unpatched versions under standard conditions, making it a reliable denial-of-service vector for local threat actors with file placement capability. SSVC considerations: exploitation is probable (straightforward crafting of invalid enum in profile), technical impact is high (denial of service), and scope is contained to local systems.

An attacker with local file system access crafts a malicious ICC color profile file containing an invalid enum value in the CIccOpDefEnvVar operation. When a user or application processes this profile through iccDEV (e.g., opening it in a color management tool or importing it into a graphics application), the library loads the invalid enum value, triggering undefined behavior that typically results in an application crash, denying service. A secondary scenario involves a supply chain compromise where a legitimate-appearing ICC profile distributed via a design resource website or embedded in a document is crafted to exploit this, causing denial of service when processed by downstream applications.