CVE-2026-34553

Katalog CVE

CVSS 4.0 · Medium EPSS 0,17%

Kerentanan Return of Stack Variable Address pada color iccdev. Skor CVSS 3.1 4.0 (Medium) menurut github.com.

Deskripsi (NVD)

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a defect in LUT dump/iteration logic affecting CIccCLUT::Iterate() and output produced by CIccMBB::Describe() (via CLUT dumping). This issue has been patched in version 2.3.1.6.

Rincian

Terbit di NVD

31 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.0 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-562: Return of Stack Variable Address
CWE-665: Improper Initialization

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 6,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-5r4q-77w5-3q3h patch · advisory vendor
• https://github.com/InternationalColorConsortium/iccDEV/issues/704 exploit · issue tracking · patch
• https://github.com/InternationalColorConsortium/iccDEV/pull/737 issue tracking · patch