CVE-2026-30981

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-30981
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-buffer-overflow read in CIccXmlArrayType<>::DumpArray() causing out-of-bounds read and/or crash. This vulnerability is fixed in 2.3.1.5.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 4.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/InternationalColorConsortium/iccDEV/issues/627 Issue Tracking
https://github.com/InternationalColorConsortium/iccDEV/pull/631 Issue Tracking Patch
https://github.com/InternationalColorConsortium/iccDEV/releases/tag/v2.3.1.5 Product
https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-pmcg-2h65-35h8 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*
History

13 Mar 2026, 20:28

Type Values Removed Values Added
References () https://github.com/InternationalColorConsortium/iccDEV/issues/627 - () https://github.com/InternationalColorConsortium/iccDEV/issues/627 - Issue Tracking
References () https://github.com/InternationalColorConsortium/iccDEV/pull/631 - () https://github.com/InternationalColorConsortium/iccDEV/pull/631 - Issue Tracking, Patch
References () https://github.com/InternationalColorConsortium/iccDEV/releases/tag/v2.3.1.5 - () https://github.com/InternationalColorConsortium/iccDEV/releases/tag/v2.3.1.5 - Product
References () https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-pmcg-2h65-35h8 - () https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-pmcg-2h65-35h8 - Patch, Vendor Advisory
First Time Color
Color iccdev
CPE cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*

11 Mar 2026, 13:53

Type Values Removed Values Added
Summary
  • (es) iccDEV proporciona un conjunto de bibliotecas y herramientas para trabajar con perfiles de gestión de color ICC. Antes de 2.3.1.5, existe una lectura de desbordamiento de búfer de pila en CIccXmlArrayType&lt;&gt;::DumpArray() causando lectura fuera de límites y/o caída. Esta vulnerabilidad está corregida en 2.3.1.5.

10 Mar 2026, 18:18

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-10 18:18

Updated : 2026-03-13 20:28

NVD link : CVE-2026-30981

Mitre link : CVE-2026-30981

CVE.ORG link : CVE-2026-30981

JSON object : View

Products Affected

color

  • iccdev
CWE
CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE-125

Out-of-bounds Read

CWE-787

Out-of-bounds Write