CVE-2026-30985

Katalog CVE

CVSS 7.8 · High EPSS 0,21%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada color iccdev. Skor CVSS 3.1 7.8 (High) menurut github.com.

Deskripsi (NVD)

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-based buffer overflow write in CIccMatrixMath::SetRange() causing memory corruption or crash. This vulnerability is fixed in 2.3.1.5.

Rincian

Terbit di NVD

10 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-122: Heap-based Buffer Overflow
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 9,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-f9wv-cq46-f9wg patch · advisory vendor
• https://github.com/InternationalColorConsortium/iccDEV/pull/636 issue tracking · patch
• https://github.com/InternationalColorConsortium/iccDEV/issues/621 issue tracking
• https://github.com/InternationalColorConsortium/iccDEV/releases/tag/v2.3.1.5 product