Iccdev CVE-2026-34542

The CVSS vector (AV:L/AC:L/PR:N/S:U/C:N/I:N/A:H) indicates this is a local-only attack with low complexity but high availability impact - realistic for denial of service scenarios. The EPSS exploitation probability is not provided in the input data, so assessment relies on vector analysis: local attack vector significantly restricts threat scope compared to network-exploitable flaws; however, no authentication is required (PR:N) and attack complexity is low (AC:L), making it straightforward for any local user to trigger if they can provide input to the iccApplyNamedCmm function. No KEV (CISA Known Exploited Vulnerability) status is documented, and no public exploit code is referenced in the provided intelligence. The confidentiality and integrity impacts are zero (C:N/I:N), meaning the buffer overflow causes application crash (availability denial) rather than information disclosure or code execution - this is a notable limiting factor for severity despite the stack-based nature of the overflow. Real-world risk is moderate: the vulnerability requires local file system access or the ability to feed a crafted ICC profile to an application using the vulnerable library, which may occur in document processing pipelines, color management tools, or imaging software, but the constraint to local attack vector and denial-of-service-only impact makes this lower priority than network-exploitable or code-execution vulnerabilities. Organizations using iccDEV in untrusted document processing workflows should prioritize patching.

An attacker with local access crafts a malicious ICC color profile file containing oversized curve set parameters in the MPE calculator structure. They place this file in a location monitored by a document processing service or image conversion tool that uses iccDEV to parse ICC profiles (e.g., a print server, digital asset management system, or web-based image processor). When the application calls iccApplyNamedCmm to process the profile, the stack buffer overflow is triggered, causing a crash and denial of service. While AddressSanitizer detects the overflow during testing, standard builds may exhibit unpredictable behavior ranging from silent corruption to application termination, depending on adjacent stack state.