CVE-2026-50278: iccDEV: CIccEmbedIO::Read8() size_t underflow

Q: Which deployments are affected?

iccDEV versions prior to 2.3.2.1 are affected when they parse ICC profiles containing icSigEmbeddedV5ProfileTag data with an icSigEmbeddedProfileType payload.

Q: What does exploitation require?

An attacker needs to cause the affected software to parse a crafted ICC profile with the specified embedded-profile tag and payload. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, and user interaction required.

Published Aug 21, 2026

Updated

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions prior to 2.3.2.1 have a CIccEmbedIO::Read8() sizet underflow. The issue arises due to an embedded-profile read defect when parsing ICC profiles containing icSigEmbeddedV5ProfileTag data with icSigEmbeddedProfileType payloads. Version 2.3.2.1 patches the issue. No known workarounds are available.

Affected Software

1 affected component

iccDEV CIccEmbedIO::Read8()<2.3.2.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade iccDEV to a version that resolves this vulnerability.
Fixed in 2.3.2.1

Event History

Aug 21, 2026

CVE Published

via MITRE·02:57 PM

Data Sourced

via MITRE·02:57 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

iccDEV versions prior to 2.3.2.1 are affected when they parse ICC profiles containing icSigEmbeddedV5ProfileTag data with an icSigEmbeddedProfileType payload.

What does exploitation require?

An attacker needs to cause the affected software to parse a crafted ICC profile with the specified embedded-profile tag and payload. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, and user interaction required.

Is a fix available, and are there mitigations if it cannot be applied?

Version 2.3.2.1 patches the issue. No known workarounds are available.