CVE-2026-24407: iccDEV has Undefined Behavior in icSigCalcOp()
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior in icSigCalcOp(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24407?
CVE-2026-24407 has a high severity due to its potential to cause undefined behavior in the iccDEV library.
How do I fix CVE-2026-24407?
To fix CVE-2026-24407, upgrade to iccDEV version 2.3.1.2 or later.
What are the affected versions of CVE-2026-24407?
CVE-2026-24407 affects iccDEV versions 2.3.1.1 and below.
What components are impacted by CVE-2026-24407?
CVE-2026-24407 impacts the icSigCalcOp() function within the iccDEV library.
Is user input involved in CVE-2026-24407?
Yes, CVE-2026-24407 involves unsafe incorporation of user-controllable input, leading to undefined behavior.