CVE-2026-34540: iccDEV: HBO in icMemDump()
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger a heap-buffer-overflow (HBO) in icMemDump() when iccDumpProfile attempts to dump/describe malformed tag contents. The issue is observable under AddressSanitizer as an out-of-bounds heap read in icMemDump(...) at IccProfLib/IccUtil.cpp:1002, reachable via CIccTagUnknown::Describe(). This issue has been patched in version 2.3.1.6.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34540?
CVE-2026-34540 is considered a high severity vulnerability due to the potential for remote code execution resulting from a heap-buffer-overflow.
How do I fix CVE-2026-34540?
To fix CVE-2026-34540, upgrade to version 2.3.1.6 or later of the iccDEV library.
What kind of attack does CVE-2026-34540 enable?
CVE-2026-34540 enables potential attackers to exploit a heap-buffer-overflow, which could lead to arbitrary code execution.
What software is affected by CVE-2026-34540?
CVE-2026-34540 affects iccDEV versions prior to 2.3.1.6.
Can CVE-2026-34540 lead to data loss?
Yes, exploitation of CVE-2026-34540 could potentially lead to data loss or corruption due to arbitrary code execution.