CVE-2026-21677
HighSummary
The iccDEV library in versions 2.3.1 and below has undefined behavior in the CIccCLUT::Init function, which initializes and sets the size of a CLUT. This issue is fixed in version 2.3.1.1.
Risk Assessment
Undefined behavior can lead to unpredictable program behavior, including potential crashes or errors in color profile processing, which may affect the stability of applications using iccDEV.
Recommendation
It is recommended to immediately update the iccDEV library to version 2.3.1.1 or later to eliminate the risk associated with undefined behavior.
Other vulnerabilities in iccDEV
See all- CVE-2026-24412High
The iccDEV library versions 2.3.1.1 and below have a heap buffer overflow vulnerability in the CIccTagXmlSegmentedCurve::ToXml() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.
- CVE-2026-24411High
The iccDEV library versions 2.3.1.1 and below have undefined behavior in the CIccTagXmlSegmentedCurve::ToXml() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.
- CVE-2026-24410High
The iccDEV library versions 2.3.1.1 and below have undefined behavior and null pointer dereference in the CIccProfileXml::ParseBasic() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.
- CVE-2026-24409High
The iccDEV library versions 2.3.1.1 and below have undefined behavior and null pointer dereference in the CIccTagXmlFloatNum<>::ParseXml() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.
- CVE-2026-24407High
The iccDEV library versions 2.3.1.1 and below have undefined behavior in the icSigCalcOp() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.
- CVE-2026-24406High
The iccDEV library versions 2.3.1.1 and below have a heap buffer overflow vulnerability in the CIccTagNamedColor2::SetSize() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.
- CVE-2026-24405High
The iccDEV library versions 2.3.1.1 and below have a heap buffer overflow vulnerability in the CIccMpeCalculator::Read() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.
- CVE-2026-24404High
The iccDEV library versions 2.3.1.1 and below have a null pointer dereference and undefined behavior vulnerability in CIccXmlArrayType(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.
- CVE-2026-24403High
The iccDEV library versions 2.3.1.1 and below have an integer overflow vulnerability in icValidateStatus CIccProfile::CheckHeader() when user-controllable input is incorporated into profile data unsafely. Tampering with tag tables, offsets, or size fields can trigger parsing errors, memory corruption, or DoS, potentially enabling arbitrary code execution or bypassing application logic. This issue has been fixed in version 2.3.1.2.
- CVE-2026-22861High
The iccDEV library before version 2.3.1.2 contains a heap-based buffer overflow vulnerability in the SIccCalcOp::Describe() function in IccProfLib/IccMpeCalc.cpp. This affects users who process ICC color profiles.
Original NVD description (English source)
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have Undefined Behavior in its CIccCLUT::Init function which initializes and sets the size of a CLUT. This issue is fixed in version 2.3.1.1.