CVE-2026-27692

Katalog CVE

CVSS 7.1 · High EPSS 0,19%

Kerentanan Out-of-bounds Read pada color iccdev. Skor CVSS 3.1 7.1 (High) menurut github.com.

Deskripsi (NVD)

iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, heap-buffer-overflow read occurs during CIccTagTextDescription::Release() when strlen() reads past a heap buffer while parsing ICC profile XML text description tags, causing a crash. Commit 29d088840b962a7cdd35993dfabc2cb35a049847 fixes the issue. No known workarounds are available.

Rincian

Terbit di NVD

25 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read
CWE-170: Improper Null Termination
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 8,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-3869-prw8-gjqr advisory vendor
• https://github.com/InternationalColorConsortium/iccDEV/commit/29d088840b962a7cdd35993dfabc2cb35a049847 patch
• https://github.com/InternationalColorConsortium/iccDEV/pull/610 issue tracking · patch
• https://github.com/InternationalColorConsortium/iccDEV/issues/609 exploit · issue tracking