iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Prior to 2.3.1.2, There is a heap-based buffer overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cpp. This vulnerability affects users of the iccDEV library who process ICC color profiles. The vulnerability is fixed in 2.3.1.2.
References
| Link | Resource |
|---|---|
| https://github.com/InternationalColorConsortium/iccDEV/commit/fa9a364c01fc2e59eb2291e1f9b1c1359b7d5329 | Patch |
| https://github.com/InternationalColorConsortium/iccDEV/pull/475 | Exploit Issue Tracking Patch |
| https://github.com/InternationalColorConsortium/iccDEV/pull/476 | Issue Tracking |
| https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-vr49-3vf8-7j5h | Third Party Advisory |
Configurations
History
16 Jan 2026, 18:46
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-787 | |
| First Time |
Color
Color iccdev |
|
| References | () https://github.com/InternationalColorConsortium/iccDEV/commit/fa9a364c01fc2e59eb2291e1f9b1c1359b7d5329 - Patch | |
| References | () https://github.com/InternationalColorConsortium/iccDEV/pull/475 - Exploit, Issue Tracking, Patch | |
| References | () https://github.com/InternationalColorConsortium/iccDEV/pull/476 - Issue Tracking | |
| References | () https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-vr49-3vf8-7j5h - Third Party Advisory | |
| CPE | cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:* |
13 Jan 2026, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-13 21:15
Updated : 2026-01-16 18:46
NVD link : CVE-2026-22861
Mitre link : CVE-2026-22861
CVE.ORG link : CVE-2026-22861
JSON object : View
Products Affected
color
- iccdev