CVE-2026-24405: iccDEV has Heap Buffer Overflow in CIccMpeCalculator::Read()
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have a Heap Buffer Overflow vulnerability in CIccMpeCalculator::Read(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24405?
CVE-2026-24405 is classified as a heap buffer overflow vulnerability, which can potentially lead to arbitrary code execution.
How do I fix CVE-2026-24405?
To mitigate CVE-2026-24405, upgrade to a version of iccDEV that is higher than 2.3.1.1.
What versions of iccDEV are affected by CVE-2026-24405?
CVE-2026-24405 affects iccDEV versions 2.3.1.1 and below.
What causes CVE-2026-24405?
CVE-2026-24405 is caused by a heap buffer overflow in the CIccMpeCalculator::Read() function.
Can CVE-2026-24405 lead to data loss?
Yes, CVE-2026-24405 can potentially lead to data loss or system crashes if exploited.