Iccdev CVE-2026-34553

CVSS 4.0 with local attack vector (AV:L), low complexity (AC:L), and no privilege requirement (PR:N) reflects limited real-world exploitability but meaningful impact in controlled environments. The integrity-only impact (I:L) with no confidentiality or availability loss indicates the defect corrupts LUT output rather than enabling code execution or data theft. Exploitation is non-trivial because it requires local filesystem access to iccDEV libraries or tools. No EPSS score, POC code, or active exploitation (KEV status not confirmed) is documented, suggesting this is a low-priority maintenance issue rather than an emergency threat. The vulnerability is most relevant to developers and vendors integrating iccDEV into color management pipelines where profile accuracy is critical; casual users of color software are unlikely to be directly exposed unless they actively process ICC profiles with vulnerable library versions.

An attacker with local system access to a machine running tools or services that use vulnerable iccDEV versions could craft or supply ICC color profiles that trigger the LUT iteration defect. When the affected CIccCLUT::Iterate() or CIccMBB::Describe() functions process these profiles, corrupted CLUT output is produced, potentially causing downstream color transformation errors or poisoning color profile databases. For example, a malicious ICC profile dumped via CIccMBB::Describe() could yield incorrect color table data that a color management system relies upon, degrading image rendering accuracy in professional color workflows. No public exploit code or active exploitation has been identified; this is a logic defect requiring deliberate local interaction to manifest.