Description
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions prior to 2.3.2.1 have a `CIccEmbedIO::Read8()` size_t underflow. The issue arises due to an embedded-profile read defect when parsing ICC profiles containing `icSigEmbeddedV5ProfileTag` data with `icSigEmbeddedProfileType` payloads. Version 2.3.2.1 patches the issue. No known workarounds are available.
Published: 2026-08-21
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Memory Corruption
Action: Apply Patch
AI Analysis

Impact

iccDEV implements ICC color management profile handling and contains a size_t underflow in the CIccEmbedIO::Read8() routine. Parsing profiles with the icSigEmbeddedV5ProfileTag and icSigEmbeddedProfileType payload can trigger the underflow, resulting in a memory corruption condition that may crash the application or allow an attacker to execute arbitrary code if the corruption is leveraged.

Affected Systems

The vulnerability afflicts all releases of the InternationalColorConsortium iccDEV libraries and tools prior to version 2.3.2.1. The supplied patch in v2.3.2.1 removes the defect. ICC profiles from untrusted sources that contain the problematic tags can trigger the issue.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate impact, and the EPSS score is not available, making it unclear how frequently the flaw is being attempted. The vulnerability is not listed in CISA’s KEV catalog. Because an attacker must supply a crafted ICC profile, the attack vector is likely local or through an application that processes profile files. The lack of a workaround means that upgrading the library is the only effective mitigant.

Generated by OpenCVE AI on August 21, 2026 at 16:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade iccDEV to version 2.3.2.1 or newer.
  • Verify that any ICC profiles processed are sourced from trusted, authenticated origins.
  • If an upgrade cannot occur immediately, restrict the handling of ICC profiles to isolated or sandboxed environments and apply integrity checks to the profiles before use.

Generated by OpenCVE AI on August 21, 2026 at 16:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Internationalcolorconsortium
Internationalcolorconsortium iccdev
Vendors & Products Internationalcolorconsortium
Internationalcolorconsortium iccdev

Fri, 21 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
Description iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions prior to 2.3.2.1 have a `CIccEmbedIO::Read8()` size_t underflow. The issue arises due to an embedded-profile read defect when parsing ICC profiles containing `icSigEmbeddedV5ProfileTag` data with `icSigEmbeddedProfileType` payloads. Version 2.3.2.1 patches the issue. No known workarounds are available.
Title iccDEV: CIccEmbedIO::Read8() size_t underflow
Weaknesses CWE-125
CWE-190
CWE-704
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Internationalcolorconsortium Iccdev
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-26T17:29:06.120Z

Reserved: 2026-06-04T16:26:05.985Z

Link: CVE-2026-50278

cve-icon Vulnrichment

Updated: 2026-08-26T17:29:01.134Z

cve-icon NVD

Status : Received

Published: 2026-08-21T15:16:41.603

Modified: 2026-08-26T18:16:38.500

Link: CVE-2026-50278

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T18:00:15Z

Weaknesses
  • CWE-125

    Out-of-bounds Read

  • CWE-190

    Integer Overflow or Wraparound

  • CWE-704

    Incorrect Type Conversion or Cast