EUVD-2026-63990Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Network-delivered malicious file with no auth required, but user must open it (UI:R); impact is crash only, no confidentiality or integrity effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions prior to 2.3.2.1 have a CIccEmbedIO::Read8() size_t underflow. The issue arises due to an embedded-profile read defect when parsing ICC profiles containing icSigEmbeddedV5ProfileTag data with icSigEmbeddedProfileType payloads. Version 2.3.2.1 patches the issue. No known workarounds are available.
AnalysisAI
Out-of-bounds read in iccDEV (all versions prior to 2.3.2.1) crashes the ICC profile parser via a size_t integer underflow in CIccEmbedIO::Read8() when processing embedded ICC v5 profiles. Unauthenticated remote attackers can trigger the denial-of-service condition by delivering a maliciously crafted ICC profile that requires user interaction to parse (e.g., opening a file in an application backed by this library). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that: (1) the target application links against iccDEV versions prior to 2.3.2.1; (2) the application parses ICC profiles containing icSigEmbeddedV5ProfileTag data with icSigEmbeddedProfileType payloads - this is a specific v5 profile feature, not present in all ICC profiles; and (3) user interaction occurs, meaning a user or automated pipeline must open or process the malicious file (UI:R per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 (Medium) reflects a realistic risk profile: network-delivered but requiring user interaction (UI:R), with impact limited to availability (A:H, C:N, I:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade iccDEV to version 2.3.2.1, which patches the size_t underflow in CIccEmbedIO::Read8() and adds null-allocation guards throughout the JSON and MPE factory layers. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
iccDEV ICC color profile library (through 2.3.1) has a use-after-free in CIccXform::Create() when processing hint object
Heap buffer overflow in iccDEV versions 2.3.1.1 and below allows remote code execution through maliciously crafted ICC c
Heap buffer overflow in iccDEV versions 2.3.1.1 and below allows remote code execution when processing maliciously craft
Heap buffer overflow in iccDEV versions 2.3.1.1 and earlier allows remote code execution through maliciously crafted ICC
Type confusion in iccDEV library versions before 2.3.1.2 allows unauthenticated attackers to achieve remote code executi
iccDEV color management library versions 2.3.1 and earlier contain undefined behavior in the CLUT initialization functio
iccDEV ICC color profile libraries versions 2.3.1.1 and earlier suffer from undefined behavior and out-of-memory errors
Heap buffer overflow in iccDEV versions before 2.3.1.2 allows remote code execution when processing malicious ICC color
Type confusion in iccDEV versions before 2.3.1.2 allows attackers to corrupt memory and achieve high-impact outcomes inc
Type confusion in iccDEV versions before 2.3.1.2 allows unauthenticated attackers to achieve remote code execution throu
Heap buffer overflow in iccDEV versions before 2.3.1.2 allows remote code execution when processing malicious ICC color
Heap buffer overflow in iccDEV versions prior to 2.3.1.2 allows remote attackers to execute arbitrary code through the C
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today