Iccdev
CVE-2026-34552
MEDIUM
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionGitHub Advisory
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is an Undefined Behavior (UB) issue in IccTagLut.cpp where the code performs member access through a null pointer of type CIccApplyCLUT. This issue has been patched in version 2.3.1.6.
AnalysisAI
Null pointer dereference in iccDEV versions prior to 2.3.1.6 causes denial of service when processing ICC color management profiles with malformed lookup table (LUT) structures. The vulnerability exists in IccTagLut.cpp where CIccApplyCLUT member access occurs without null validation, allowing local attackers to crash applications that parse untrusted color profiles. No public exploit code or active exploitation has been confirmed at time of analysis.
Technical ContextAI
iccDEV is the reference implementation library for ICC color management profiles, a widely-used standard for color space definition and transformation. The vulnerability is a classic null pointer dereference (CWE-476) occurring during LUT (lookup table) tag processing in the CIccApplyCLUT class. The flaw allows attackers to craft malicious ICC profile files that trigger undefined behavior by attempting member access on a null pointer, which in C++ may cause immediate crashes, memory corruption, or unpredictable behavior depending on compiler optimization levels and runtime environment. The affected CPE cpe:2.3:a:internationalcolorconsortium:iccdev:*:*:*:*:*:*:*:* indicates all iccDEV versions before the patched release are affected.
RemediationAI
Vendor-released patch: iccDEV version 2.3.1.6 and later contain the fix. Affected users should upgrade immediately to version 2.3.1.6 or later. For developers and maintainers using iccDEV as a dependency, update the library version in build configurations and recompile applications. The fix is also available in GitHub pull request #730 (https://github.com/InternationalColorConsortium/iccDEV/pull/730) for those building from source. Until patching is feasible, input validation and restriction of ICC profile sources to trusted vendors mitigates risk in environments where profile parsing cannot be immediately upgraded.
iccDEV ICC color profile library (through 2.3.1) has a use-after-free in CIccXform::Create() when processing hint object
Heap buffer overflow in iccDEV versions 2.3.1.1 and below allows remote code execution through maliciously crafted ICC c
Heap buffer overflow in iccDEV versions 2.3.1.1 and below allows remote code execution when processing maliciously craft
Heap buffer overflow in iccDEV versions 2.3.1.1 and earlier allows remote code execution through maliciously crafted ICC
Type confusion in iccDEV library versions before 2.3.1.2 allows unauthenticated attackers to achieve remote code executi
iccDEV color management library versions 2.3.1 and earlier contain undefined behavior in the CLUT initialization functio
iccDEV ICC color profile libraries versions 2.3.1.1 and earlier suffer from undefined behavior and out-of-memory errors
Heap buffer overflow in iccDEV versions before 2.3.1.2 allows remote code execution when processing malicious ICC color
Type confusion in iccDEV versions before 2.3.1.2 allows attackers to corrupt memory and achieve high-impact outcomes inc
Type confusion in iccDEV versions before 2.3.1.2 allows unauthenticated attackers to achieve remote code execution throu
Heap buffer overflow in iccDEV versions before 2.3.1.2 allows remote code execution when processing malicious ICC color
Heap buffer overflow in iccDEV versions prior to 2.3.1.2 allows remote attackers to execute arbitrary code through the C
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Null Pointer Dereference
View allShare
External POC / Exploit Code
Leaving vuln.today