CVE-2026-34536: iccDEV: SO in SIccCalcOp::ArgsUsed()
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger a stack overflow (SO) in SIccCalcOp::ArgsUsed(). The issue is observable under AddressSanitizer as a stack-overflow when iccApplyProfiles processes a malicious profile, with the crash occurring while computing argument usage during calculator underflow/overflow checks. This issue has been patched in version 2.3.1.6.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34536?
CVE-2026-34536 is classified as a high severity vulnerability due to its potential to trigger a stack overflow.
How do I fix CVE-2026-34536?
To fix CVE-2026-34536, update your iccDEV installation to version 2.3.1.6 or later.
What can trigger the CVE-2026-34536 vulnerability?
The CVE-2026-34536 vulnerability can be triggered by a crafted ICC profile that exploits the SIccCalcOp::ArgsUsed() function.
Which versions of iccDEV are affected by CVE-2026-34536?
Versions of iccDEV prior to 2.3.1.6 are affected by CVE-2026-34536.
What type of issue is CVE-2026-34536?
CVE-2026-34536 is a stack overflow vulnerability that affects the handling of ICC color management profiles.