PT-2026-5049 · Iccdev · Iccdev

Xsscx · Published 2026-01-28 · Updated 2026-01-28 · CVE-2026-24852

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions iccDEV versions prior to 2.3.1.2

Description iccDEV is a set of libraries and tools for interacting with ICC color management profiles. A heap buffer over-read can occur when the strlen() function processes a non-null-terminated buffer, potentially leaking heap memory contents and causing application termination. This affects users of the iccDEV library who process ICC color profiles. ICC Profile Injection vulnerabilities can arise when user-controllable input is incorporated into ICC profile data in an unsafe manner.

Recommendations Update to version 2.3.1.2 or later.

Exploit

Fix

Heap Based Buffer Overflow

Out of bounds Read

Weakness Enumeration

CWE-170

CWE-122

CWE-125

Related Identifiers

CVE-2026-24852

GHSA-Q8G2-MP32-3J7F

Affected Products

Iccdev

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24852.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-24852 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24852 · Vendor Advisory
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-q8g2-mp32-3j7f · Note
• https://github.com/InternationalColorConsortium/iccDEV/pull/540 · Note
• https://github.com/InternationalColorConsortium/iccDEV/commit/3092499cd4d0775f4a716b999899f9c26f9bc614 · Note
• https://twitter.com/VulmonFeeds/status/2016450804597522935 · Twitter Post
• https://twitter.com/CVEnew/status/2016319513650749941 · Twitter Post
• https://t.me/CVEtracker/43098 · Telegram Post