CVE-2026-24856

Katalog CVE

CVSS 7.8 · High EPSS 0,25%

Kerentanan Improper Input Validation pada color iccdev. Skor CVSS 3.1 7.8 (High) menurut github.com.

Deskripsi (NVD)

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Versions prior to 2.3.1.2 have an undefined behavior issue when floating-point NaN values are converted to unsigned short integer types during ICC profile XML parsing potentially corrupting memory structures and enabling arbitrary code execution. This vulnerability affects users of the iccDEV library who process ICC color profiles. ICC Profile Injection vulnerabilities arise when user-controllable input is incorporated into ICC profile data or other structured binary blobs in an unsafe manner. Version 2.3.1.2 contains a fix for the issue. No known workarounds are available.

Rincian

Terbit di NVD

28 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-681: Incorrect Conversion between Numeric Types
CWE-704: Incorrect Type Conversion or Cast

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/InternationalColorConsortium/iccDEV/issues/532 exploit · issue tracking · advisory vendor
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-w585-cv3v-c396 patch · advisory vendor
• https://github.com/InternationalColorConsortium/iccDEV/commit/5e53a5d25923b7794ba44e390e9b35d391f2b9c1 patch
• https://github.com/InternationalColorConsortium/iccDEV/pull/541 exploit · issue tracking · patch