CVE-2026-31796

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-31796
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-based buffer overflow in icCurvesFromXml() causing heap memory corruption or crash. This vulnerability is fixed in 2.3.1.5.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/InternationalColorConsortium/iccDEV/issues/651 Issue Tracking
https://github.com/InternationalColorConsortium/iccDEV/pull/658 Issue Tracking Patch
https://github.com/InternationalColorConsortium/iccDEV/releases/tag/v2.3.1.5 Product
https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-mv6h-vpcg-pwfx Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*
History

13 Mar 2026, 20:34

Type Values Removed Values Added
References () https://github.com/InternationalColorConsortium/iccDEV/issues/651 - () https://github.com/InternationalColorConsortium/iccDEV/issues/651 - Issue Tracking
References () https://github.com/InternationalColorConsortium/iccDEV/pull/658 - () https://github.com/InternationalColorConsortium/iccDEV/pull/658 - Issue Tracking, Patch
References () https://github.com/InternationalColorConsortium/iccDEV/releases/tag/v2.3.1.5 - () https://github.com/InternationalColorConsortium/iccDEV/releases/tag/v2.3.1.5 - Product
References () https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-mv6h-vpcg-pwfx - () https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-mv6h-vpcg-pwfx - Patch, Vendor Advisory
CPE cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*
First Time Color
Color iccdev

11 Mar 2026, 13:53

Type Values Removed Values Added
Summary
  • (es) iccDEV proporciona un conjunto de bibliotecas y herramientas para trabajar con perfiles de gestión de color ICC. Antes de 2.3.1.5, existe un desbordamiento de búfer basado en montículo en icCurvesFromXml() que causa corrupción de memoria del montículo o un fallo. Esta vulnerabilidad está corregida en 2.3.1.5.

10 Mar 2026, 18:19

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-10 18:19

Updated : 2026-03-13 20:34

NVD link : CVE-2026-31796

Mitre link : CVE-2026-31796

CVE.ORG link : CVE-2026-31796

JSON object : View

Products Affected

color

  • iccdev
CWE
CWE-122

Heap-based Buffer Overflow

CWE-787

Out-of-bounds Write