CVE-2026-22861: iccDEV has a heap-buffer-overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cpp
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Prior to 2.3.1.2, There is a heap-based buffer overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cpp. This vulnerability affects users of the iccDEV library who process ICC color profiles. The vulnerability is fixed in 2.3.1.2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22861?
CVE-2026-22861 is classified as high severity due to its potential to cause a heap-buffer-overflow, which can lead to arbitrary code execution.
How do I fix CVE-2026-22861?
To fix CVE-2026-22861, you should update iccDEV to version 2.3.1.2 or later.
What software versions are affected by CVE-2026-22861?
CVE-2026-22861 affects all versions of iccDEV prior to 2.3.1.2.
What is a heap-buffer-overflow in the context of CVE-2026-22861?
In the context of CVE-2026-22861, a heap-buffer-overflow occurs when data exceeds the boundaries of a dynamically allocated memory buffer, potentially allowing for exploitation.
Which library function is associated with CVE-2026-22861?
CVE-2026-22861 is associated with the SIccCalcOp::Describe() function in IccProfLib/IccMpeCalc.cpp.