PT-2026-5226 · Iccdev · Iccdev

Xsscx · Published 2026-01-28 · Updated 2026-01-29 · CVE-2026-24856

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iccDEV versions prior to 2.3.1.2

Description iccDEV is a set of libraries and tools for interacting with ICC color management profiles. A flaw exists in versions prior to 2.3.1.2 where undefined behavior occurs during the conversion of floating-point NaN values to unsigned short integer types when parsing ICC profile XML data. This can lead to memory corruption and potential arbitrary code execution. The issue arises from unsafe handling of user-controllable input incorporated into ICC profile data, creating ICC Profile Injection vulnerabilities.

Recommendations Update to iccDEV version 2.3.1.2 or later.

Exploit

Fix

Incorrect Type Conversion or Cast

RCE

Weakness Enumeration

CWE-681

CWE-704

CWE-20

Related Identifiers

CVE-2026-24856

GHSA-W585-CV3V-C396

Affected Products

Iccdev

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24856.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-24856 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24856 · Vendor Advisory
• https://github.com/InternationalColorConsortium/iccDEV/pull/541 · Note
• https://github.com/InternationalColorConsortium/iccDEV/commit/5e53a5d25923b7794ba44e390e9b35d391f2b9c1 · Note
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-w585-cv3v-c396 · Note
• https://github.com/InternationalColorConsortium/iccDEV/issues/532 · Note
• https://twitter.com/VulmonFeeds/status/2016658155128623226 · Twitter Post
• https://t.me/CVEtracker/43199 · Telegram Post
• https://twitter.com/CVEnew/status/2016623851992408287 · Twitter Post