CVE-2026-24852

Katalog CVE

CVSS 8.1 · High EPSS 0,29%

Kerentanan Heap-based Buffer Overflow pada color iccdev. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, a heap buffer over-read when the strlen() function attempts to read a non-null-terminated buffer potentially leaking heap memory contents and causing application termination. This vulnerability affects users of the iccDEV library who process ICC color profiles. ICC Profile Injection vulnerabilities arise when user-controllable input is incorporated into ICC profile data or other structured binary blobs in an unsafe manner. Version 2.3.1.2 contains a fix for the issue. No known workarounds are available.

Rincian

Terbit di NVD

28 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow
CWE-125: Out-of-bounds Read
CWE-170: Improper Null Termination

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 20,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-q8g2-mp32-3j7f patch · advisory vendor
• https://github.com/InternationalColorConsortium/iccDEV/commit/3092499cd4d0775f4a716b999899f9c26f9bc614 patch
• https://github.com/InternationalColorConsortium/iccDEV/pull/540 issue tracking · patch