Iccdev
CVE-2026-34553
MEDIUM
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionGitHub Advisory
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a defect in LUT dump/iteration logic affecting CIccCLUT::Iterate() and output produced by CIccMBB::Describe() (via CLUT dumping). This issue has been patched in version 2.3.1.6.
AnalysisAI
Local integrity modification in iccDEV prior to version 2.3.1.6 affects the CIccCLUT::Iterate() function and CLUT dumping output in CIccMBB::Describe(), allowing local attackers without privileges to alter ICC color profile data integrity. The vulnerability requires local access and produces incorrect LUT (Look-Up Table) dump output that could compromise color management workflows relying on accurate profile representation.
Technical ContextAI
iccDEV is the official toolkit maintained by the International Color Consortium for creating and validating ICC color profiles. The vulnerability exists in the LUT (Look-Up Table) iteration and dumping logic within the CLUT (Color Look-Up Table) component of the library. CWE-562 (Return Inside Finally Block) indicates a control flow defect where exception handling or early returns in the LUT iteration mechanism produce corrupted or incorrect output when dumping CLUT data structures via the CIccMBB::Describe() method. This affects downstream tools and applications that depend on iccDEV libraries to read, validate, or serialize ICC profile CLUT data, potentially distributing incorrect color transformation information.
RemediationAI
Vendor-released patch: iccDEV 2.3.1.6 or later. Developers and system administrators using iccDEV should update the library to version 2.3.1.6 to receive the patched CIccCLUT::Iterate() and CLUT dumping logic. The fix is available via the International Color Consortium's GitHub repository (https://github.com/InternationalColorConsortium/iccDEV). Upstream fixes are documented in PR #737 and Issue #704. Workarounds are not applicable; patching is the only remedy. Applications and color management tools built on vulnerable iccDEV versions should be rebuilt and redeployed with the updated library.
iccDEV ICC color profile library (through 2.3.1) has a use-after-free in CIccXform::Create() when processing hint object
Heap buffer overflow in iccDEV versions 2.3.1.1 and below allows remote code execution through maliciously crafted ICC c
Heap buffer overflow in iccDEV versions 2.3.1.1 and below allows remote code execution when processing maliciously craft
Heap buffer overflow in iccDEV versions 2.3.1.1 and earlier allows remote code execution through maliciously crafted ICC
Type confusion in iccDEV library versions before 2.3.1.2 allows unauthenticated attackers to achieve remote code executi
iccDEV color management library versions 2.3.1 and earlier contain undefined behavior in the CLUT initialization functio
iccDEV ICC color profile libraries versions 2.3.1.1 and earlier suffer from undefined behavior and out-of-memory errors
Heap buffer overflow in iccDEV versions before 2.3.1.2 allows remote code execution when processing malicious ICC color
Type confusion in iccDEV versions before 2.3.1.2 allows attackers to corrupt memory and achieve high-impact outcomes inc
Type confusion in iccDEV versions before 2.3.1.2 allows unauthenticated attackers to achieve remote code execution throu
Heap buffer overflow in iccDEV versions before 2.3.1.2 allows remote code execution when processing malicious ICC color
Heap buffer overflow in iccDEV versions prior to 2.3.1.2 allows remote attackers to execute arbitrary code through the C
Same weakness CWE-562 – Return of Stack Variable Address
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today