Iccdev
CVE-2026-34548
MEDIUM
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is an Undefined Behavior (UB) condition in the XML conversion tooling path (iccToXml) caused by an implicit conversion from a negative signed integer to icUInt32Number (unsigned 32-bit), which changes the value. This issue has been patched in version 2.3.1.6.
AnalysisAI
Denial of service in iccDEV prior to version 2.3.1.6 allows local attackers to crash the iccToXml XML conversion tool via undefined behavior caused by implicit conversion of negative signed integers to unsigned 32-bit values. The vulnerability has CVSS 6.2 (medium severity) and affects all versions before the patched release; no public exploit code has been identified, but the issue is straightforward to trigger with malformed ICC color profiles containing negative integer values.
Technical ContextAI
iccDEV is a library and toolset for ICC (International Color Consortium) color management profile processing. The vulnerability resides in the iccToXml conversion utility, which parses ICC profiles and outputs XML representations. The root cause is CWE-681 (Incorrect Conversion Between Numeric Types), specifically an implicit cast from a signed integer to icUInt32Number (unsigned 32-bit). When a negative signed value is implicitly converted to unsigned, the bit pattern is reinterpreted, producing an unexpectedly large positive value or undefined behavior depending on the compiler and platform. This occurs during XML conversion of ICC profile data, likely when processing numeric fields that should remain non-negative but are incorrectly signed in input or intermediate processing. The CPE cpe:2.3:a:internationalcolorconsortium:iccdev:*:*:*:*:*:*:*:* indicates all versions of the iccDEV product are affected prior to the patch.
RemediationAI
Vendor-released patch: iccDEV version 2.3.1.6 and later. Users must upgrade to 2.3.1.6 or newer from the official International Color Consortium GitHub repository (https://github.com/InternationalColorConsortium/iccDEV). For users unable to immediately upgrade, temporarily restrict iccToXml processing to trusted, validated ICC profiles and avoid exposing the tool to untrusted or user-supplied color profile inputs. The fix was implemented in pull request #725 (https://github.com/InternationalColorConsortium/iccDEV/pull/725); see also the security advisory GHSA-prwp-9gv6-ccxv for additional context. Rebuild and redeploy any applications or services that bundle or invoke iccToXml after patching.
iccDEV ICC color profile library (through 2.3.1) has a use-after-free in CIccXform::Create() when processing hint object
Heap buffer overflow in iccDEV versions 2.3.1.1 and below allows remote code execution through maliciously crafted ICC c
Heap buffer overflow in iccDEV versions 2.3.1.1 and below allows remote code execution when processing maliciously craft
Heap buffer overflow in iccDEV versions 2.3.1.1 and earlier allows remote code execution through maliciously crafted ICC
Type confusion in iccDEV library versions before 2.3.1.2 allows unauthenticated attackers to achieve remote code executi
iccDEV color management library versions 2.3.1 and earlier contain undefined behavior in the CLUT initialization functio
iccDEV ICC color profile libraries versions 2.3.1.1 and earlier suffer from undefined behavior and out-of-memory errors
Heap buffer overflow in iccDEV versions before 2.3.1.2 allows remote code execution when processing malicious ICC color
Type confusion in iccDEV versions before 2.3.1.2 allows attackers to corrupt memory and achieve high-impact outcomes inc
Type confusion in iccDEV versions before 2.3.1.2 allows unauthenticated attackers to achieve remote code execution throu
Heap buffer overflow in iccDEV versions before 2.3.1.2 allows remote code execution when processing malicious ICC color
Heap buffer overflow in iccDEV versions prior to 2.3.1.2 allows remote attackers to execute arbitrary code through the C
Same weakness CWE-681 – Incorrect Conversion between Numeric Types
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today