iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior and Null Pointer Deference in CIccProfileXml::ParseBasic(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Sat, 24 Jan 2026 11:00:00 +0900
| Type | Values Removed | Values Added |
|---|---|---|
| Description | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior and Null Pointer Deference in CIccProfileXml::ParseBasic(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2. | |
| Title | iccDEV has Undefined Behavior and Null Pointer Deference in CIccProfileXml::ParseBasic() | |
| Weaknesses | CWE-20 CWE-476 CWE-690 CWE-758 |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-01-24T01:12:32.146Z
Reserved: 2026-01-22T18:19:49.174Z
Link: CVE-2026-24410
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-01-24T02:15:49.080
Modified: 2026-01-24T02:15:49.080
Link: CVE-2026-24410
Redhat
No data.
OpenCVE Enrichment
No data.