CVE-2026-24406: iccDEV has Heap Buffer Overflow in CIccTagNamedColor2::SetSize()
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have a Heap Buffer Overflow vulnerability in CIccTagNamedColor2::SetSize(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24406?
CVE-2026-24406 is classified as a high severity vulnerability due to the potential for remote code execution through heap buffer overflow.
How do I fix CVE-2026-24406?
To fix CVE-2026-24406, update the iccDEV Libraries to version 2.3.1.2 or higher, which addresses the heap buffer overflow issue.
What software versions are affected by CVE-2026-24406?
CVE-2026-24406 affects iccDEV Libraries version 2.3.1.1 and below.
What types of issues can CVE-2026-24406 lead to?
CVE-2026-24406 can lead to serious security risks including potential remote code execution, data corruption, and system instability.
Who is the vendor for the CVE-2026-24406 vulnerability?
The vendor for the CVE-2026-24406 vulnerability is iccDEV, which develops libraries and tools for ICC color management profiles.