CVE-2026-34533 Details
Description
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger Undefined Behavior (UB) in CIccCalculatorFunc::ApplySequence() due to invalid enum values being loaded for icChannelFuncSignature. The issue is observable under UBSan as a “load of value … not a valid value for type icChannelFuncSignature”, indicating a type/enum value confusion scenario during ICC profile processing. This issue has been patched in version 2.3.1.6.
A vulnerability in iccDEV versions prior to 2.3.1.6 allows crafted ICC profiles to trigger undefined behavior in the function CIccCalculatorFunc::ApplySequence(). This issue arises from invalid enum values being loaded for icChannelFuncSignature, leading to a type confusion during ICC profile processing. The vulnerability can be detected under Undefined Behavior Sanitizer (UBSan) as a runtime error, indicating that an invalid value was loaded for the expected enum type. This flaw can cause a crash, creating a denial-of-service condition.
Users can update to iccDEV version 2.3.1.6 or later, which addresses the vulnerability by properly defining the icChannelFuncSignature enum, adding sentinel range values for safe validation, and correcting the handling of ICC profiles to prevent the type confusion that led to the undefined behavior.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/InternationalColorConsortium/iccDEV/issues/664 | [email protected] | ExploitIssue Tracking |
| https://github.com/InternationalColorConsortium/iccDEV/pull/681 | [email protected] | Issue TrackingPatch |
| https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-8jj3-77m7-c3pq | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-758 | Reliance on Undefined, Unspecified, or Implementation-Defined Behavior | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| color iccdev | < 2.3.1.6 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | Initial Analysis | [email protected] |
| Mar 31, 2026 | New CVE Received | [email protected] |