Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.2
CVE-2026-34555: iccDEV library may overflow memory and crash
CVE-2026-34555 · published 7 months ago
Summary
Versions of iccDEV before 2.3.1.6 can write past the end of a small memory area on the stack when processing color profile data. This can cause the program to crash or behave unpredictably. Upgrade to iccDEV version 2.3.1.6 or later to fix the issue.
Original advisory text
iccDEV: SBO in CIccTagFixedNum::GetValues()
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a stack-buffer-overflow (SBO) in CIccTagFixedNum<>::GetValues() and a related bug chain. The primary crash is an AddressSanitizer-reported WRITE of size 4 that overflows a 4-byte stack variable (rv) via the call chain CIccTagFixedNum::GetValues() -> CIccTagStruct::GetElemNumberValue(). This issue has been patched in version 2.3.1.6.
References
- https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-... Vendor Advisory
- https://github.com/InternationalColorConsortium/iccDEV/issues/696 Third Party Advisory
- https://github.com/InternationalColorConsortium/iccDEV/pull/739 Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34555... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-34555 Vendor Advisory
- https://github.com/InternationalColorConsortium/iccDEV/issues/697 Third Party Advisory
- https://github.com/InternationalColorConsortium/iccDEV/issues/698 Third Party Advisory
- https://github.com/InternationalColorConsortium/iccDEV/issues/703 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published31 Mar 2026
Updated4 Nov 2026
First seen31 Mar 2026
Track software like this
Free during beta