CVE-2026-30982

Katalog CVE

CVSS 6.1 · Medium EPSS 0,18%

Kerentanan Heap-based Buffer Overflow pada color iccdev. Skor CVSS 3.1 6.1 (Medium) menurut github.com.

Deskripsi (NVD)

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap out-of-bounds read in CIccPcsXform::pushXYZConvert() causing crash and potentially leaking memory contents. This vulnerability is fixed in 2.3.1.5.

Rincian

Terbit di NVD

10 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow
CWE-125: Out-of-bounds Read
CWE-129: Improper Validation of Array Index

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-7ww3-h4w6-x5hf patch · advisory vendor
• https://github.com/InternationalColorConsortium/iccDEV/pull/632 issue tracking · patch
• https://github.com/InternationalColorConsortium/iccDEV/issues/625 issue tracking
• https://github.com/InternationalColorConsortium/iccDEV/releases/tag/v2.3.1.5 product