← Back

CVE-2026-34535

nvd nist
Published: Mar 31, 2026Modified: Jun 17, 2026

JSON object

Loading...
5.5
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Exploitability: 1.8 / Impact: 3.6
Source: NVD

Description

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger a segmentation fault (SEGV) in CIccTagArray::Cleanup(). The issue is observable under UBSan/ASan as misaligned member access / misaligned pointer loads followed by an invalid read leading to process crash when running iccRoundTrip on a malicious profile. This issue has been patched in version 2.3.1.6.

Affected (1)

Products: Color: Iccdev
Color
1 product
Iccdev
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Iccdev
Before 2.3.1.6

Related CWEs

CWE-122
Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

References (4)

Source: security-advisories@github.com
ExploitIssue Tracking
Source: security-advisories@github.com
Issue TrackingPatch
Source: security-advisories@github.com
PatchVendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
ExploitIssue Tracking

Timeline

No history available yet.