CVE-2026-24412: iccDEV has Heap Buffer Overflow in icCurvesFromXml()
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have aHeap Buffer Overflow vulnerability in the CIccTagXmlSegmentedCurve::ToXml() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24412?
CVE-2026-24412 is classified as a critical vulnerability due to the potential for remote code execution caused by a heap buffer overflow.
How do I fix CVE-2026-24412?
To fix CVE-2026-24412, users should upgrade to iccDEV version 2.3.1.2 or later, where the vulnerability has been addressed.
What systems are affected by CVE-2026-24412?
CVE-2026-24412 affects all versions of iccDEV up to and including 2.3.1.1.
What are the potential consequences of exploiting CVE-2026-24412?
Exploiting CVE-2026-24412 can lead to arbitrary code execution, potentially allowing an attacker to take full control of the affected system.
How can I determine if my system is vulnerable to CVE-2026-24412?
You can determine if your system is vulnerable to CVE-2026-24412 by checking the version of iccDEV installed and comparing it against the affected versions.