CVE-2026-22861

Katalog CVE

CVSS 8.8 · High EPSS 0,71%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada color iccdev. Skor CVSS 3.1 8.8 (High) menurut github.com.

Deskripsi (NVD)

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Prior to 2.3.1.2, There is a heap-based buffer overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cpp. This vulnerability affects users of the iccDEV library who process ICC color profiles. The vulnerability is fixed in 2.3.1.2.

Rincian

Terbit di NVD

13 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-130: Improper Handling of Length Parameter Inconsistency
CWE-252: Unchecked Return Value
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,71% peluang dieksploitasi; lebih tinggi dari 52,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/InternationalColorConsortium/iccDEV/commit/fa9a364c01fc2e59eb2291e1f9b1c1359b7d5329 patch
• https://github.com/InternationalColorConsortium/iccDEV/pull/475 exploit · issue tracking · patch
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-vr49-3vf8-7j5h advisory pihak ketiga
• https://github.com/InternationalColorConsortium/iccDEV/pull/476 issue tracking