Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 113

Export CSV
CVE-2026-24411

iccDEV has Undefined Behavior and Null Pointer Deference in CIccTagXmlSegmentedCurve::ToXml()

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior in CIccTagXmlSegmentedCurve::ToXml(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-24412

iccDEV has Heap Buffer Overflow in icCurvesFromXml()

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have aHeap Buffer Overflow vulnerability in the CIccTagXmlSegmentedCurve::ToXml() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-24852

iccDEV has a heap-buffer-overflow in icXmlParseTextString()

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, a heap buffer over-read when the strlen() function attempts to read a non-null-terminated buffer potentially leaking heap memory contents and causing application termination. This vulnerability affects users of the iccDEV library who process ICC color profiles. ICC Profile Injection vulnerabilities arise when user-controllable input is incorporated into ICC profile data or other structured binary blobs in an unsafe manner. Version 2.3.1.2 contains a fix for the issue. No known workarounds are available.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-24856

iccDEV has UB runtime error in <icTagTypeSignature>

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Versions prior to 2.3.1.2 have an undefined behavior issue when floating-point NaN values are converted to unsigned short integer types during ICC profile XML parsing potentially corrupting memory structures and enabling arbitrary code execution. This vulnerability affects users of the iccDEV library who process ICC color profiles. ICC Profile Injection vulnerabilities arise when user-controllable input is incorporated into ICC profile data or other structured binary blobs in an unsafe manner. Version 2.3.1.2 contains a fix for the issue. No known workarounds are available.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-25503

iccDEV Has Type Confusion in CIccTagEmbeddedHeightImage::Validate()

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, type confusion allowed malformed ICC profiles to trigger undefined behavior when loading invalid icImageEncodingType values causing denial of service. This issue has been patched in version 2.3.1.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-25584

iccDEV vulnerable to Stack-based Buffer Overflow in CIccTagFloatNum::GetValues()

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.3, there is a stack-buffer-overflow vulnerability in CIccTagFloatNum<>::GetValues(). This is triggered when processing a malformed ICC profile. The vulnerability allows an out-of-bounds write on the stack, potentially leading to memory corruption, information disclosure, or code execution when processing specially crafted ICC files. This issue has been patched in version 2.3.1.3.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-25585

iccDEV vulnerable to OOB in CIccXform3DLut::Apply()

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.3, there is a vulnerability IccCmm.cpp:5793 when reading through index during ICC profile processing. The malformed ICC profile triggers improper array bounds validation in the color management module, resulting in an out-of-bounds read that can lead to memory disclosure or segmentation fault from accessing memory beyond the array boundary. This issue has been patched in version 2.3.1.3.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-25634

iccDEV memcpy-param-overlap in CIccTagMultiProcessElement::Apply()

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to 2.3.1.4, SrcPixel and DestPixel stack buffers overlap in CIccTagMultiProcessElement::Apply() int IccTagMPE.cpp. This vulnerability is fixed in 2.3.1.4.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-30983

iccDEV has a stack buffer overflow in icFixXml()

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a stack buffer overflow in icFixXml() (strcpy) causing stack memory corruption or crash. This vulnerability is fixed in 2.3.1.5.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-30985

iccDEV has a heap-based buffer overflow write in CIccMatrixMath::SetRange()

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-based buffer overflow write in CIccMatrixMath::SetRange() causing memory corruption or crash. This vulnerability is fixed in 2.3.1.5.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-30987

iccDEV has a stack buffer overflow in CIccTagNum<(icTagTypeSignature)>::GetValues()

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a stack buffer overflow in CIccTagNum<>::GetValues() causing stack memory corruption or crash. This vulnerability is fixed in 2.3.1.5.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-31796

iccDEV has a heap-based buffer overflow in icCurvesFromXml()

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-based buffer overflow in icCurvesFromXml() causing heap memory corruption or crash. This vulnerability is fixed in 2.3.1.5.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-30979

iccDEV has a heap-based buffer overflow in CIccCalculatorFunc::InitSelectOp()

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-based buffer overflow in CIccCalculatorFunc::InitSelectOp() triggered with local user interaction causing memory corruption/crash. This vulnerability is fixed in 2.3.1.5.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-30986

iccDEV has a heap-based buffer overflow write in CIccCLUT::Interp3d()

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-based buffer overflow write in CIccMatrixMath::SetRange() causing memory corruption or crash. This vulnerability is fixed in 2.3.1.5.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-31795

iccDEV has a stack buffer overflow write in CIccXform3DLut::Apply()

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a stack buffer overflow write in CIccXform3DLut::Apply() corrupting stack memory or crash. This vulnerability is fixed in 2.3.1.5.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-30978

Heap-use-after-free in CIccCmm::AddXform()

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-use-after-free in CIccCmm::AddXform() causing invalid vptr dereference and crash. This vulnerability is fixed in 2.3.1.5.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-30981

iccDEV has a heap-buffer-overflow read in CIccXmlArrayType<>

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-buffer-overflow read in CIccXmlArrayType<>::DumpArray() causing out-of-bounds read and/or crash. This vulnerability is fixed in 2.3.1.5.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-30982

iccDEV has a heap out-of-bounds read in CIccPcsXform::pushXYZConvert()

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap out-of-bounds read in CIccPcsXform::pushXYZConvert() causing crash and potentially leaking memory contents. This vulnerability is fixed in 2.3.1.5.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-30984

iccDEV has a heap out-of-bounds read in CIccCalculatorFunc::ApplySequence()

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap out-of-bounds read in CIccCalculatorFunc::ApplySequence() causing an application crash. This vulnerability is fixed in 2.3.1.5.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev
CVE-2026-31792

iccDEV has a null pointer dereference in CIccTagXmlStruct::ParseTag()

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a null pointer dereference in CIccTagXmlStruct::ParseTag() causing a segmentation fault or denial of service. This vulnerability is fixed in 2.3.1.5.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Color Internationalcolorconsortium
Products
Iccdev Iccdev