CVE-2026-34541: iccDEV: UB in CIccCombinedConnectionConditions::CIccCombinedConnectionConditions()
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger Undefined Behavior (UB) via a null-pointer member call in CIccCombinedConnectionConditions::CIccCombinedConnectionConditions() (reported by UBSan as “member call on null pointer of type CIccTagSpectralViewingConditions”). The issue is reachable when running iccApplyNamedCmm with -PCC using a malformed .icc profile. This issue has been patched in version 2.3.1.6.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34541?
CVE-2026-34541 is considered a high severity vulnerability due to the potential for undefined behavior caused by a crafted ICC profile.
How do I fix CVE-2026-34541?
To mitigate CVE-2026-34541, upgrade to iccDEV version 2.3.1.6 or later.
What type of vulnerability is CVE-2026-34541?
CVE-2026-34541 is a vulnerability that leads to undefined behavior in the iccDEV library due to a null-pointer member call.
What products are affected by CVE-2026-34541?
CVE-2026-34541 affects iccDEV versions prior to 2.3.1.6.
Is there a known exploit for CVE-2026-34541?
As of now, there is no publicly known exploit for CVE-2026-34541, but users are encouraged to update to avoid potential risks.