Iccdev CVE-2026-34546

CVSS score of 6.2 with AV:L (local attack vector) and AC:L (low complexity) indicates the vulnerability is easily exploitable by a local user with file placement capability, but requires local system access-not remote exploitability. CVSS correctly assigns zero to Confidentiality and Integrity impacts, focusing impact on Availability (high). However, the practical risk is constrained: exploitation requires a user to run iccTiffDump against a malicious TIFF file, making this a denial-of-service vulnerability rather than a critical system compromise vector. The absence of KEV status and public exploit code at time of analysis suggests low active exploitation despite public disclosure via GitHub. Patch availability (version 2.3.1.6) and upstream PR/commit references (GitHub issue #719, PR #723) indicate vendor responsiveness. For organizations using iccDEV in batch processing, automated test suites, or untrusted input pipelines, the availability impact warrants prompt patching; for others, priority is lower.

An attacker with local file system access places a crafted TIFF file on a shared system and monitors for batch processing jobs or automated workflows running iccTiffDump. When the tool processes the malicious TIFF (e.g., during color profile extraction or validation in an image processing pipeline), the division by zero is triggered, crashing iccTiffDump and disrupting the workflow. Exploitation requires no special privileges beyond file placement and depends on the application running the tool against untrusted input; no public exploit code or active in-the-wild exploitation has been identified.