CVE-2026-34537: iccDEV: UB in CIccOpDefEnvVar::Exec()
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger Undefined Behavior (UB) in CIccOpDefEnvVar::Exec() due to invalid enum values being loaded for icSigCmmEnvVar. The issue is observable under UBSan as a “load of value … not a valid value for type icSigCmmEnvVar”, indicating an invalid enum/type value being consumed during ICC profile processing. This issue has been patched in version 2.3.1.6.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34537?
CVE-2026-34537 is classified as a high severity vulnerability due to the potential for undefined behavior that could be exploited.
How do I fix CVE-2026-34537?
To fix CVE-2026-34537, upgrade to iccDEV version 2.3.1.6 or later.
What kind of vulnerability is CVE-2026-34537?
CVE-2026-34537 is a vulnerability that involves undefined behavior caused by invalid enum values in the execution of specific functions.
What software is affected by CVE-2026-34537?
CVE-2026-34537 affects iccDEV versions before 2.3.1.6.
What can happen if CVE-2026-34537 is exploited?
Exploiting CVE-2026-34537 may lead to unpredictable application behavior, crashes, or potential system compromise.