95
CVEs
1
Critical
48
High
0
KEV
59
PoC
11
Unpatched C/H
67.4%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
48
MEDIUM
45
LOW
1
Monthly CVE Trend
Affected Products (6)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-21675 | iccDEV ICC color profile library (through 2.3.1) has a use-after-free in CIccXform::Create() when processing hint objects. Processing a malicious ICC profile can lead to code execution. PoC available, fixed in 2.3.1.1. | CRITICAL | 9.8 | 0.2% | 69 |
PoC
|
| CVE-2026-24405 | Heap buffer overflow in iccDEV versions 2.3.1.1 and earlier allows remote code execution through maliciously crafted ICC color profiles when user input is processed by CIccMpeCalculator::Read(). Public exploit code exists for this vulnerability, enabling attackers to execute arbitrary code, cause denial of service, or manipulate application data. The vulnerability is fixed in version 2.3.1.2. | HIGH | 8.8 | 0.2% | 64 |
PoC
|
| CVE-2026-24406 | Heap buffer overflow in iccDEV versions 2.3.1.1 and below allows remote code execution when processing maliciously crafted ICC color profiles, with public exploit code currently available. An unauthenticated attacker can trigger the vulnerability through user-supplied input to the CIccTagNamedColor2::SetSize() function, enabling arbitrary code execution, denial of service, or data manipulation. The vulnerability has been patched in version 2.3.1.2. | HIGH | 8.8 | 0.2% | 64 |
PoC
|
| CVE-2026-24412 | Heap buffer overflow in iccDEV versions 2.3.1.1 and below allows remote code execution through maliciously crafted ICC color profile data submitted to the CIccTagXmlSegmentedCurve::ToXml() function. Public exploit code exists for this vulnerability, enabling attackers to achieve denial of service, data manipulation, and arbitrary code execution with no authentication required. The vulnerability affects all users of the vulnerable iccDEV library versions and has been resolved in version 2.3.1.2. | HIGH | 8.8 | 0.2% | 64 |
PoC
|
| CVE-2026-21485 | iccDEV ICC color profile libraries versions 2.3.1.1 and earlier suffer from undefined behavior and out-of-memory errors that can be exploited remotely without authentication to achieve code execution or denial of service. Public exploit code exists for this vulnerability, affecting users who have not upgraded to version 2.3.1.2 or later. An attacker can trigger memory corruption through specially crafted ICC profile inputs with user interaction. | HIGH | 8.8 | 0.2% | 64 |
PoC
|
| CVE-2026-21677 | iccDEV color management library versions 2.3.1 and earlier contain undefined behavior in the CLUT initialization function that can be exploited remotely without authentication to achieve code execution, information disclosure, or denial of service. Public exploit code exists for this vulnerability which affects all users of the vulnerable library versions. A patch is available in version 2.3.1.1 and should be applied immediately. | HIGH | 8.8 | 0.2% | 64 |
PoC
|
| CVE-2026-21688 | Type confusion in iccDEV library versions before 2.3.1.2 allows unauthenticated attackers to achieve remote code execution with user interaction by crafting malicious ICC color profiles. Public exploit code exists for this vulnerability affecting organizations that process color management profiles through the iccDEV libraries. A patch is available in version 2.3.1.2 with no known workarounds prior to upgrading. | HIGH | 8.8 | 0.2% | 64 |
PoC
|
| CVE-2026-21682 | Heap buffer overflow in iccDEV versions before 2.3.1.2 allows remote code execution when processing malicious ICC color profiles, affecting applications that use the library to handle color management data. An attacker can trigger the vulnerability through a crafted profile file requiring only user interaction to open, potentially achieving complete system compromise. Public exploit code exists and no patch is currently available. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2026-21692 | Type confusion in iccDEV versions before 2.3.1.2 allows unauthenticated attackers to achieve remote code execution through malicious ICC color profiles processed by the ToXmlCurve() function. Public exploit code exists for this vulnerability, affecting any application or system using the vulnerable iccDEV library to parse color management profiles. A patch is available in version 2.3.1.2 and should be applied immediately. | HIGH | 8.8 | 0.1% | 64 |
PoC
|
| CVE-2026-21693 | Type confusion in iccDEV versions before 2.3.1.2 allows attackers to corrupt memory and achieve high-impact outcomes including code execution, data theft, and denial of service when processing malicious ICC color profiles. The vulnerability exists in the CIccSegmentedCurveXml::ToXml() function and affects any application using the iccDEV library to handle color management data. Public exploit code exists for this vulnerability, though a patch is available in version 2.3.1.2 and later. | HIGH | 8.8 | 0.1% | 64 |
PoC
|
| CVE-2026-22047 | Heap buffer overflow in iccDEV versions before 2.3.1.2 allows remote code execution when processing malicious ICC color profiles, affecting applications that use the iccDEV library to manage color data. Public exploit code exists for this vulnerability, enabling attackers to execute arbitrary code with high impact on confidentiality, integrity, and availability. Update to version 2.3.1.2 or later to remediate. | HIGH | 8.8 | 0.1% | 64 |
PoC
|
| CVE-2026-21679 | Heap buffer overflow in iccDEV versions prior to 2.3.1.2 allows remote attackers to execute arbitrary code through the CIccLocalizedUnicode::GetText() function with minimal attack complexity. The vulnerability affects users of the ICC color profile manipulation library and has public exploit code available. Organizations using vulnerable versions should upgrade to 2.3.1.2 or later immediately. | HIGH | 8.8 | 0.1% | 64 |
PoC
|
| CVE-2026-21676 | Heap buffer overflow in iccDEV versions 2.3.1 and earlier allows remote attackers to execute arbitrary code or crash the application through malformed ICC color profile data processed by the CIccMBB::Validate function. Public exploit code exists for this vulnerability, which affects all users handling untrusted color profiles. Upgrade to version 2.3.1.1 or later to remediate. | HIGH | 8.8 | 0.1% | 64 |
PoC
|
| CVE-2026-22861 | Memory corruption in iccDEV library versions before 2.3.1.2 allows remote attackers to achieve code execution via maliciously crafted ICC color profiles, affecting users who process untrusted profile data. Public exploit code exists for this vulnerability. Organizations using iccDEV should upgrade to version 2.3.1.2 immediately. | HIGH | 8.8 | 0.1% | 64 |
PoC
|
| CVE-2026-22255 | Heap buffer overflow in iccDEV versions before 2.3.1.2 allows remote code execution when processing malicious ICC color profiles, affecting applications using the iccDEV library to handle color management data. Public exploit code exists for this vulnerability, and no patches are currently available. An attacker can trigger memory corruption through a crafted ICC profile to achieve arbitrary code execution without user interaction beyond opening the malicious file. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|