CVE-2026-24410

iccDEV has Undefined Behavior and Null Pointer Deference in CIccProfileXml::ParseBasic()

Published Jan 24, 2026 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior and Null Pointer Deference in CIccProfileXml::ParseBasic(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.

Analysis

Technical impact

A flaw in iccDEV’s CIccProfileXml::ParseBasic() function causes undefined behavior and null‑pointer dereferences when user‑controlled ICC profile data or other structured binary blobs are processed. The improper handling can lead to program crashes, corrupt or tampered data, bypass of application logic, and in extreme cases remote code execution within the process. The vulnerability is driven by maliciously crafted profile files or blobs.

Affected Systems

The issue affects the InternationalColorConsortium iccDEV libraries and tools up to and including version 2.3.1.1. Versions thereafter are unaffected.

Risk and Exploitability

With an overall CVSS score of 7.1, the vulnerability is considered moderately high. The EPSS score is under 1 %, indicating a low probability of exploitation in the wild. It is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation requires an attacker who can supply crafted ICC profiles or binary data, for which the attack vector is inferred to be local or any environment where user input can reach the parsing routine.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

InternationalColorConsortium

iccDEV

affected

Version	Status	Constraints
`< 2.3.1.2`	affected	—

Configuration 1 [-]

cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*

No data.

Vendor	Product	Versions
Internationalcolorconsortium	Iccdev	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade iccDEV to version 2.3.1.2 or later, which removes the vulnerability.
If an upgrade is not immediately possible, restrict or validate all ICC profile inputs before they reach CIccProfileXml::ParseBasic() to avoid null dereference and undefined behavior.
Monitor application logs for abnormal crashes or data integrity issues that may indicate attempted exploitation.

Generated by OpenCVE AI on April 18, 2026 at 02:58 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.373% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/InternationalColorConsortium/iccDEV/commit/3cf522b13832692b107322cd51c4ae5c3a21f366
https://github.com/InternationalColorConsortium/iccDEV/issues/507
https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-398q-4rpv-3v9r

History

Jan 30, 2026 6:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Color Color iccdev
CPEs		cpe:2.3:a:color:iccdev::::::::
Vendors & Products		Color Color iccdev

Jan 26, 2026 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jan 26, 2026 12:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Internationalcolorconsortium Internationalcolorconsortium iccdev
Vendors & Products		Internationalcolorconsortium Internationalcolorconsortium iccdev

Jan 24, 2026 2:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior and Null Pointer Deference in CIccProfileXml::ParseBasic(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
Title		iccDEV has Undefined Behavior and Null Pointer Deference in CIccProfileXml::ParseBasic()
Weaknesses		CWE-20 CWE-476 CWE-690 CWE-758
References		https://github.com/InternationalColorConsortium/iccDEV/commit/3cf522b13832692b107322cd51c4ae5c3a21f366 https://github.com/InternationalColorConsortium/iccDEV/issues/507 https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-398q-4rpv-3v9r
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H'}`