CVE-2026-24403
HighSummary
The iccDEV library versions 2.3.1.1 and below have an integer overflow vulnerability in icValidateStatus CIccProfile::CheckHeader() when user-controllable input is incorporated into profile data unsafely. Tampering with tag tables, offsets, or size fields can trigger parsing errors, memory corruption, or DoS, potentially enabling arbitrary code execution or bypassing application logic. This issue has been fixed in version 2.3.1.2.
Risk Assessment
An attacker could exploit this vulnerability to disrupt system availability, manipulate data, or achieve remote code execution, potentially leading to severe security and data integrity breaches.
Recommendation
It is recommended to immediately upgrade the iccDEV library to version 2.3.1.2 or later to mitigate the risk associated with this vulnerability.
Other vulnerabilities in iccDEV
See all- CVE-2026-24412High
The iccDEV library versions 2.3.1.1 and below have a heap buffer overflow vulnerability in the CIccTagXmlSegmentedCurve::ToXml() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.
- CVE-2026-24411High
The iccDEV library versions 2.3.1.1 and below have undefined behavior in the CIccTagXmlSegmentedCurve::ToXml() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.
- CVE-2026-24410High
The iccDEV library versions 2.3.1.1 and below have undefined behavior and null pointer dereference in the CIccProfileXml::ParseBasic() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.
- CVE-2026-24409High
The iccDEV library versions 2.3.1.1 and below have undefined behavior and null pointer dereference in the CIccTagXmlFloatNum<>::ParseXml() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.
- CVE-2026-24407High
The iccDEV library versions 2.3.1.1 and below have undefined behavior in the icSigCalcOp() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.
- CVE-2026-24406High
The iccDEV library versions 2.3.1.1 and below have a heap buffer overflow vulnerability in the CIccTagNamedColor2::SetSize() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.
- CVE-2026-24405High
The iccDEV library versions 2.3.1.1 and below have a heap buffer overflow vulnerability in the CIccMpeCalculator::Read() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.
- CVE-2026-24404High
The iccDEV library versions 2.3.1.1 and below have a null pointer dereference and undefined behavior vulnerability in CIccXmlArrayType(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and code execution. This issue has been fixed in version 2.3.1.2.
- CVE-2026-22861High
The iccDEV library before version 2.3.1.2 contains a heap-based buffer overflow vulnerability in the SIccCalcOp::Describe() function in IccProfLib/IccMpeCalc.cpp. This affects users who process ICC color profiles.
- CVE-2026-22255High
iccDEV before version 2.3.1.2 has a heap-buffer-overflow vulnerability in `CIccCLUT::Init()` at `IccProfLib/IccTagLut.cpp`. This affects users processing ICC color profiles. Version 2.3.1.2 contains a patch.
Original NVD description (English source)
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In versions 2.3.1.1 and below, an integer overflow vulnerability exists in icValidateStatus CIccProfile::CheckHeader() when user-controllable input is incorporated into profile data unsafely. Tampering with tag tables, offsets, or size fields can trigger parsing errors, memory corruption, or DoS, potentially enabling arbitrary Code Execution or bypassing application logic. This issue has been fixed in version 2.3.1.2.