PT-2026-29393 · Iccdev · Iccdev

Xsscx · Published 2026-03-31 · Updated 2026-04-01 · CVE-2026-34548

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions iccDEV versions prior to 2.3.1.6

Description iccDEV is a set of libraries and tools for working with ICC color management profiles. Versions prior to 2.3.1.6 contain an Undefined Behavior (UB) condition in the XML conversion tooling path (iccToXml) due to an implicit conversion from a negative signed integer to icUInt32Number (unsigned 32-bit), which alters the value.

Recommendations Versions prior to 2.3.1.6 should be updated to version 2.3.1.6 or later.

Exploit

Fix

Weakness Enumeration

CWE-681

Related Identifiers

CVE-2026-34548

GHSA-PRWP-9GV6-CCXV

Affected Products

Iccdev

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34548.json · Exploit
• 🔥 https://github.com/InternationalColorConsortium/iccDEV/issues/722 · Exploit
• https://github.com/InternationalColorConsortium/iccDEV/pull/725 · Patch
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-prwp-9gv6-ccxv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34548 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34548 · Security Note
• https://twitter.com/infoflowcloud/status/2039280994126094489 · Twitter Post
• https://twitter.com/CVEnew/status/2039279726787989550 · Twitter Post