CVE-2026-24404: iccDEV has Null Pointer Deference and Undefined Behavior in CIccXmlArrayType()
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In versions 2.3.1.1 and below, CIccXmlArrayType() contains a Null Pointer Dereference and Undefined Behavior vulnerability. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24404?
CVE-2026-24404 has been classified as a moderate vulnerability due to its potential to cause application crashes.
How do I fix CVE-2026-24404?
To fix CVE-2026-24404, upgrade to iccDEV version 2.3.1.2 or later, where the issue has been resolved.
What types of behaviors are associated with CVE-2026-24404?
CVE-2026-24404 is associated with Null Pointer Dereference and Undefined Behavior in the CIccXmlArrayType() function.
What software is affected by CVE-2026-24404?
CVE-2026-24404 affects iccDEV Libraries versions up to and including 2.3.1.1.
Are there any workarounds for CVE-2026-24404?
There are no recommended workarounds; upgrading to a patched version is the best method to mitigate CVE-2026-24404.