iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile and TIFF input can trigger a heap-buffer-overflow (HBO) in CTiffImg::WriteLine(). The issue is observable under AddressSanitizer as an out-of-bounds heap read when running iccSpecSepToTiff on a malicious .icc + .tif pair, leading to a crash during TIFF strip writing. This issue has been patched in version 2.3.1.6.
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger Undefined Behavior (UB) in CIccOpDefEnvVar::Exec() due to invalid enum values being loaded for icSigCmmEnvVar. The issue is observable under UBSan as a “load of value … not a valid value for type icSigCmmEnvVar”, indicating an invalid enum/type value being consumed during ICC profile processing. This issue has been patched in version 2.3.1.6.
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger a stack overflow (SO) in SIccCalcOp::ArgsUsed(). The issue is observable under AddressSanitizer as a stack-overflow when iccApplyProfiles processes a malicious profile, with the crash occurring while computing argument usage during calculator underflow/overflow checks. This issue has been patched in version 2.3.1.6.
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger a segmentation fault (SEGV) in CIccTagArray::Cleanup(). The issue is observable under UBSan/ASan as misaligned member access / misaligned pointer loads followed by an invalid read leading to process crash when running iccRoundTrip on a malicious profile. This issue has been patched in version 2.3.1.6.
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger a heap-buffer-overflow (HBO) in CIccMpeSpectralMatrix::Describe(). The issue is observable under AddressSanitizer as an out-of-bounds heap read when running iccDumpProfile on a malicious profile. This issue has been patched in version 2.3.1.6.
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger Undefined Behavior (UB) in CIccCalculatorFunc::ApplySequence() due to invalid enum values being loaded for icChannelFuncSignature. The issue is observable under UBSan as a “load of value … not a valid value for type icChannelFuncSignature”, indicating a type/enum value confusion scenario during ICC profile processing. This issue has been patched in version 2.3.1.6.
An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.27.0 allows an attacker to maliciously craft a PDF that can trigger an integer overflow within the 'pdf_load_image_imp' function. This allows a heap out-of-bounds write that could be exploited for arbitrary code execution.
Integer Overflow or Wraparound vulnerability in InsightSoftwareConsortium ITK (Modules/ThirdParty/Expat/src/expat modules).This issue affects ITK: before 2.7.1.
The Ecover Builder For Dummies plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'ecover' shortcode in all versions up to and including 1.0. This is due to insufficient input sanitization and output escaping on the user-supplied 'id' shortcode attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Simple Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' post meta (Custom Field) in all versions up to and including 2.6.2. This is due to insufficient input sanitization and output escaping on the author display name when no author URL is present. The plugin accesses `$draft_data->display_name` which, because `display_name` is not a native WP_Post property, triggers WP_Post::__get() and resolves to `get_post_meta($post_id, 'display_name', true)`. When the `user_url` meta field is empty, the `$author` value is assigned to `$author_link` on line 383 without any escaping (unlike line 378 which uses `esc_html()` for the `{{author}}` tag, and line 381 which uses `esc_html()` when a URL is present). This unescaped value is then inserted into the shortcode output via `str_replace()`. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page containing the `[drafts]` shortcode with the `{{author+link}}` template tag.
OmniGen2-RL contains an unauthenticated remote code execution vulnerability in the reward server component that allows remote attackers to execute arbitrary commands by sending malicious HTTP POST requests. Attackers can exploit insecure pickle deserialization of request bodies to achieve code execution on the host system running the exposed service.
The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field meta values in all versions up to, and including, 2.5.1. This is due to the plugin's sanitization function `sec_check_post_fields()` only running on the `save_post` hook, while WordPress allows custom fields to be added via the `wp_ajax_add_meta` AJAX endpoint without triggering `save_post`. The `ce_filter()` function then outputs these unsanitized meta values directly into page content without escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-30980 is a medium severity stack-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw exists in the CIccBasicStructFactory::CreateStruct() function, where uncontrolled recursion leads to stack exhaustion and a crash. Exploitation requires local access and user interaction, with no privileges needed. The vulnerability impacts availability by causing application crashes but does not affect confidentiality or integrity. No known exploits are currently in the wild. The issue is fixed in version 2.3.
CVE-2026-31797 is a medium severity vulnerability in iccDEV, a library suite for ICC color profile management. Versions prior to 2.3.1.5 contain a heap out-of-bounds read in the CTiffImg::ReadLine() function when processing crafted TIFF images via iccApplyProfiles. This flaw can lead to memory disclosure or application crashes. Exploitation requires local access and user interaction, with no privileges needed. The vulnerability affects confidentiality and availability but not integrity. No known exploits are currently reported in the wild. The issue is fixed in version 2.
CVE-2026-31796 is a high-severity heap-based buffer overflow vulnerability in the icCurvesFromXml() function of the iccDEV library, used for ICC color profile management. Versions prior to 2.3.1.5 are affected, allowing an attacker with local access and user interaction to trigger heap memory corruption, potentially leading to application crashes or arbitrary code execution. The vulnerability requires the victim to process a crafted ICC profile XML data, and no privileges are needed to exploit it. Although no known exploits are currently in the wild, the impact on confidentiality, integrity, and availability is high. The issue is fixed in version 2.3.1.
CVE-2026-31795 is a high-severity stack-based buffer overflow vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw exists in the CIccXform3DLut::Apply() function, where input size is not properly checked before copying data, leading to potential stack memory corruption or application crashes. Exploitation requires local access and user interaction but does not require privileges. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS score of 7.8. No known exploits are currently reported in the wild. Organizations using iccDEV for ICC color profile management should update to version 2.
CVE-2026-31794 is a medium severity vulnerability in iccDEV, a library for handling ICC color profiles. Versions prior to 2.3.1.5 contain an out-of-bounds read in the CIccCLUT::Interp3d() function, leading to a segmentation fault and denial of service. Exploitation requires local access and user interaction, but no privileges. The flaw does not impact confidentiality or integrity but causes application crashes, affecting availability. No known exploits are reported in the wild. The vulnerability is fixed in version 2.3.
CVE-2026-31793 is an out-of-bounds read vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw occurs in the CIccCalculatorFunc::ApplySequence() function, where an invalid or wild pointer read can cause a segmentation fault, leading to denial of service. Exploitation requires local access and user interaction, but no privileges are needed. The vulnerability impacts availability without affecting confidentiality or integrity. No known exploits are currently reported in the wild. The issue is fixed in version 2.3.
CVE-2026-31792 is a high-severity vulnerability in iccDEV, a library used for ICC color profile management. The flaw is a NULL pointer dereference in the CIccTagXmlStruct::ParseTag() function, which can cause a segmentation fault leading to denial of service. This affects all iccDEV versions prior to 2.3.1.5. Exploitation requires user interaction and local access, as the attack vector is local with low attack complexity and no privileges required. The vulnerability impacts confidentiality, integrity, and availability due to potential crashes and memory corruption. No known exploits are currently reported in the wild. The issue is fixed in version 2.