iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger Undefined Behavior (UB) in CIccCalculatorFunc::ApplySequence() due to invalid enum values being loaded for icChannelFuncSignature. The issue is observable under UBSan as a “load of value … not a valid value for type icChannelFuncSignature”, indicating a type/enum value confusion scenario during ICC profile processing. This issue has been patched in version 2.3.1.6.
CVE-2026-30980 is a medium severity stack-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw exists in the CIccBasicStructFactory::CreateStruct() function, where uncontrolled recursion leads to stack exhaustion and a crash. Exploitation requires local access and user interaction, with no privileges needed. The vulnerability impacts availability by causing application crashes but does not affect confidentiality or integrity. No known exploits are currently in the wild. The issue is fixed in version 2.3.
CVE-2026-31797 is a medium severity vulnerability in iccDEV, a library suite for ICC color profile management. Versions prior to 2.3.1.5 contain a heap out-of-bounds read in the CTiffImg::ReadLine() function when processing crafted TIFF images via iccApplyProfiles. This flaw can lead to memory disclosure or application crashes. Exploitation requires local access and user interaction, with no privileges needed. The vulnerability affects confidentiality and availability but not integrity. No known exploits are currently reported in the wild. The issue is fixed in version 2.
CVE-2026-31796 is a high-severity heap-based buffer overflow vulnerability in the icCurvesFromXml() function of the iccDEV library, used for ICC color profile management. Versions prior to 2.3.1.5 are affected, allowing an attacker with local access and user interaction to trigger heap memory corruption, potentially leading to application crashes or arbitrary code execution. The vulnerability requires the victim to process a crafted ICC profile XML data, and no privileges are needed to exploit it. Although no known exploits are currently in the wild, the impact on confidentiality, integrity, and availability is high. The issue is fixed in version 2.3.1.
CVE-2026-31795 is a high-severity stack-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw exists in the CIccXform3DLut::Apply() function, where input size is not properly checked before copying data, leading to potential stack memory corruption or application crashes. Exploitation requires local access and user interaction but does not require privileges. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS score of 7.8. No known exploits are currently reported in the wild. Organizations using iccDEV for ICC color profile management should update to version 2.
CVE-2026-31794 is a medium severity vulnerability in iccDEV, a library for handling ICC color profiles. Versions prior to 2.3.1.5 contain an out-of-bounds read in the CIccCLUT::Interp3d() function, leading to a segmentation fault and denial of service. Exploitation requires local access and user interaction, but no privileges. The flaw does not impact confidentiality or integrity but causes application crashes, affecting availability. No known exploits are reported in the wild. The vulnerability is fixed in version 2.3.
CVE-2026-31793 is an out-of-bounds read vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw occurs in the CIccCalculatorFunc::ApplySequence() function, where an invalid or wild pointer read can cause a segmentation fault, leading to denial of service. Exploitation requires local access and user interaction, but no privileges are needed. The vulnerability impacts availability without affecting confidentiality or integrity. No known exploits are currently reported in the wild. The issue is fixed in version 2.3.
CVE-2026-31792 is a high-severity vulnerability in iccDEV, a library used for ICC color profile management. The flaw is a NULL pointer dereference in the CIccTagXmlStruct::ParseTag() function, which can cause a segmentation fault leading to denial of service. This affects all iccDEV versions prior to 2.3.1.5. Exploitation requires user interaction and local access, as the attack vector is local with low attack complexity and no privileges required. The vulnerability impacts confidentiality, integrity, and availability due to potential crashes and memory corruption. No known exploits are currently reported in the wild. The issue is fixed in version 2.
CVE-2026-30987 is a high-severity stack-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw exists in the CIccTagNum<>::GetValues() function, where input size is not properly checked before copying data to a stack buffer, leading to potential stack memory corruption or application crashes. Exploitation requires local access and user interaction, but no privileges are needed. Successful exploitation could allow attackers to execute arbitrary code, compromise confidentiality, integrity, and availability of affected systems. No known exploits are currently reported in the wild. The vulnerability affects software that processes ICC color profiles, which are widely used in imaging, printing, and color management applications. Organizations relying on iccDEV for color profile handling should upgrade to version 2.
CVE-2026-30986 is a medium severity vulnerability in the InternationalColorConsortium's iccDEV library prior to version 2.3.1.5. It involves a heap-based buffer overflow write in the CIccMatrixMath::SetRange() function, which can cause memory corruption or application crashes. The vulnerability requires local access and user interaction to exploit, with no impact on confidentiality or integrity but can affect availability. No known exploits are currently in the wild. The issue is fixed in version 2.3.1.
CVE-2026-30985 is a high-severity heap-based buffer overflow vulnerability in the iccDEV library, specifically in the CIccMatrixMath::SetRange() function prior to version 2.3.1.5. This vulnerability arises from improper bounds checking during buffer copy operations, leading to potential memory corruption, application crashes, or exploitation. The flaw requires local access and user interaction but no privileges, making exploitation moderately challenging. Successful exploitation could allow attackers to execute arbitrary code, compromise confidentiality, integrity, and availability of affected systems. No known exploits are currently reported in the wild. Organizations using iccDEV versions before 2.3.
CVE-2026-30984 is a medium severity vulnerability in the iccDEV library used for ICC color profile management. It involves a heap out-of-bounds read in the CIccCalculatorFunc::ApplySequence() function, which can cause application crashes. The flaw affects versions prior to 2.3.1.5 and requires user interaction but no privileges. Exploitation is local and can lead to denial of service but not data integrity or confidentiality loss. No known exploits are currently in the wild. The issue is fixed in version 2.3.
CVE-2026-30983 is a high-severity stack-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw exists in the icFixXml() function, which uses an unsafe strcpy call without verifying input size, leading to potential stack memory corruption or crashes. Exploitation requires local access and user interaction, but no privileges are needed. Successful exploitation could result in full confidentiality, integrity, and availability compromise of affected systems. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to applications relying on iccDEV for ICC color profile management. The vulnerability is fixed in version 2.3.
CVE-2026-30982 is a heap-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw exists in the function CIccPcsXform::pushXYZConvert(), where a heap out-of-bounds read can cause application crashes and potentially leak memory contents. Exploitation requires local access and user interaction, with no privileges needed. The vulnerability impacts confidentiality and availability but not integrity, and no known exploits are currently reported in the wild. The issue is fixed in version 2.3.1.
CVE-2026-30981 is a medium severity heap-buffer-overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw exists in the CIccXmlArrayType<>::DumpArray() function, which performs a buffer copy without proper bounds checking, leading to out-of-bounds reads and potential application crashes. Exploitation requires local access and user interaction, as indicated by the CVSS vector, and does not require privileges. While no known exploits are currently in the wild, successful exploitation could cause denial of service due to crashes. The vulnerability impacts confidentiality minimally but has a high impact on availability. Organizations using iccDEV for ICC color profile management should upgrade to version 2.3.
CVE-2026-30979 is a high-severity heap-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw exists in the CIccCalculatorFunc::InitSelectOp() function and can be triggered by local user interaction, leading to memory corruption, crashes, and potentially arbitrary code execution. Exploitation requires local access and user interaction but does not require prior privileges. The vulnerability impacts confidentiality, integrity, and availability due to the possibility of executing malicious code or causing denial of service. No known exploits are currently reported in the wild. The issue is fixed in version 2.3.
CVE-2026-30978 is a high-severity use-after-free vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw exists in the CIccCmm::AddXform() function, where a heap-use-after-free leads to invalid virtual pointer dereference and application crash. Exploitation requires local access and user interaction but no privileges. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS score of 7.8. No known exploits are currently reported in the wild. The issue is fixed in version 2.
iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, heap-buffer-overflow read occurs during CIccTagTextDescription::Release() when strlen() reads past a heap buffer while parsing ICC profile XML text description tags, causing a crash. Commit 29d088840b962a7cdd35993dfabc2cb35a049847 fixes the issue. No known workarounds are available.
iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, signed integer overflow in iccFromCube.cpp during multiplication triggers undefined behavior, potentially causing crashes or incorrect ICC profile generation when processing crafted/large cube inputs. Commit 43ae18dd69fc70190d3632a18a3af2f3da1e052a fixes the issue. No known workarounds are available.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to 2.3.1.4, SrcPixel and DestPixel stack buffers overlap in CIccTagMultiProcessElement::Apply() int IccTagMPE.cpp. This vulnerability is fixed in 2.3.1.4.