Iccdev CVE-2026-34540

The CVSS 3.1 score of 6.2 reflects moderate risk with a local attack vector (AV:L), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and impact limited to availability (A:H with C:N, I:N). While CVSS indicates the vulnerability is exploitable, the local-only attack vector significantly constrains real-world impact compared to remote or network-adjacent variants. The EPSS score is not provided, but the combination of local attack requirement and read-only memory access (no code execution, no data modification) suggests this ranks below network-exploitable heap overflows in triage priority. The absence of KEV status and public exploit code further indicates this is not an active threat. However, organizations using iccDEV in automated profile-processing pipelines (e.g., image conversion tools, color management servers) should prioritize patching, as a denial-of-service impact could disrupt services if untrusted profiles are processed. The straightforward mitigation (upgrade to 2.3.1.6) makes this a standard patch-and-move-on priority rather than an emergency.

An attacker with local file system access crafts a malicious ICC color profile with a malformed tag structure (e.g., a tag header declaring a length that exceeds actual allocated buffer size). When a local user or automated service running iccDEV processes this profile-such as via an image editing tool, color management utility, or batch conversion pipeline-iccDumpProfile invokes the profile description routine, which calls CIccTagUnknown::Describe() for unrecognized tags. This in turn calls icMemDump() to display tag contents, triggering the out-of-bounds heap read at line 1002. The process crashes due to heap corruption detected by memory protection mechanisms (or via AddressSanitizer in instrumented builds), resulting in denial of service. While the attacker cannot achieve code execution or data modification with this specific bug, repeated crashes could disrupt automated image processing workflows.