PT-2026-29405 · Iccdev · Iccdev

Xsscx · Published 2026-03-31 · Updated 2026-04-01 · CVE-2026-34556

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions iccDEV versions prior to 2.3.1.6

Description iccDEV provides libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a heap-buffer-overflow (HBO) exists in the icAnsiToUtf8() function within the XML conversion path. This issue is triggered by a crafted ICC profile that causes icAnsiToUtf8(std::string&, char const*) to treat an input buffer as a C-string and perform operations relying on strlen() and null-termination. AddressSanitizer reports an out-of-bounds read of size 115 past a 114-byte heap allocation, observed when running the iccToXml tool.

Recommendations Versions prior to 2.3.1.6 should be updated to version 2.3.1.6 or later.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-34556

GHSA-P9WM-XFV4-43QG

Affected Products

Iccdev

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34556.json · Exploit
• https://github.com/InternationalColorConsortium/iccDEV/pull/740 · Patch
• https://github.com/InternationalColorConsortium/iccDEV/issues/734 · Patch
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-p9wm-xfv4-43qg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34556 · Security Note
• https://osv.dev/vulnerability/CVE-2026-34556 · Vendor Advisory
• https://twitter.com/CVEnew/status/2039279716545548535 · Twitter Post