CVE-2026-27691: iccDEV has SIO in parse3DTable() at iccFromCube.cpp Line 218
iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, signed integer overflow in iccFromCube.cpp during multiplication triggers undefined behavior, potentially causing crashes or incorrect ICC profile generation when processing crafted/large cube inputs. Commit 43ae18dd69fc70190d3632a18a3af2f3da1e052a fixes the issue. No known workarounds are available.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27691?
CVE-2026-27691 is classified as a critical vulnerability due to the potential for undefined behavior caused by signed integer overflow.
How do I fix CVE-2026-27691?
To mitigate CVE-2026-27691, upgrade to iccDEV version 2.3.1.5 or later, which resolves the integer overflow issue.
What versions of iccDEV are affected by CVE-2026-27691?
CVE-2026-27691 affects all iccDEV versions up to and including 2.3.1.4.
What are the potential impacts of CVE-2026-27691?
The potential impacts of CVE-2026-27691 include application crashes and the possibility of arbitrary code execution due to undefined behavior.
Is CVE-2026-27691 an exploitable vulnerability?
Yes, CVE-2026-27691 is considered exploitable if an attacker can manipulate the input to trigger the signed integer overflow.