iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have a Heap Buffer Overflow vulnerability in CIccTagNamedColor2::SetSize(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Sat, 24 Jan 2026 10:15:00 +0900
| Type | Values Removed | Values Added |
|---|---|---|
| Description | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have a Heap Buffer Overflow vulnerability in CIccTagNamedColor2::SetSize(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2. | |
| Title | iccDEV has Heap Buffer Overflow in CIccTagNamedColor2::SetSize() | |
| Weaknesses | CWE-122 CWE-20 |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-01-24T01:02:33.184Z
Reserved: 2026-01-22T18:19:49.173Z
Link: CVE-2026-24406
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-01-24T01:15:51.073
Modified: 2026-01-24T01:15:51.073
Link: CVE-2026-24406
Redhat
No data.
OpenCVE Enrichment
No data.