iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have a Heap Buffer Overflow vulnerability in CIccTagNamedColor2::SetSize(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
References
| Link | Resource |
|---|---|
| https://github.com/InternationalColorConsortium/iccDEV/commit/90c71cba2c563b1f5dc84197f827540d1baaea67 | Patch |
| https://github.com/InternationalColorConsortium/iccDEV/issues/480 | Exploit Issue Tracking |
| https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-h9h3-45cm-j95f | Patch Vendor Advisory |
Configurations
History
30 Jan 2026, 18:24
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:* | |
| First Time |
Color
Color iccdev |
|
| References | () https://github.com/InternationalColorConsortium/iccDEV/commit/90c71cba2c563b1f5dc84197f827540d1baaea67 - Patch | |
| References | () https://github.com/InternationalColorConsortium/iccDEV/issues/480 - Exploit, Issue Tracking | |
| References | () https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-h9h3-45cm-j95f - Patch, Vendor Advisory |
24 Jan 2026, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-24 01:15
Updated : 2026-01-30 18:24
NVD link : CVE-2026-24406
Mitre link : CVE-2026-24406
CVE.ORG link : CVE-2026-24406
JSON object : View
Products Affected
color
- iccdev