CVE-2026-24404

Katalog CVE

CVSS 8.8 · High EPSS 0,46%

Kerentanan Improper Input Validation pada color iccdev. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In versions 2.3.1.1 and below, CIccXmlArrayType() contains a Null Pointer Dereference and Undefined Behavior vulnerability. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.

Rincian

Terbit di NVD

24 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-476: NULL Pointer Dereference
CWE-690: Unchecked Return Value to NULL Pointer Dereference
CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-hqfg-45jp-hp9f patch · advisory vendor
• https://github.com/InternationalColorConsortium/iccDEV/commit/cd637eb33f0c8055fa54d8776e00555d3d39ef0c patch
• https://github.com/InternationalColorConsortium/iccDEV/issues/488 exploit · issue tracking