CVE-2026-34556 Details
Description
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a heap-buffer-overflow (HBO) in icAnsiToUtf8() in the XML conversion path. The issue is triggered by a crafted ICC profile which causes icAnsiToUtf8(std::string&, char const*) to treat an input buffer as a C-string and call operations that rely on strlen()/null-termination. AddressSanitizer reports an out-of-bounds READ of size 115 past a 114-byte heap allocation, with the failure observed while running the iccToXml tool. This issue has been patched in version 2.3.1.6.
A heap-buffer-overflow vulnerability has been identified in the iccDEV library, specifically in the 'icAnsiToUtf8()' function within the XML conversion process. This vulnerability, present in versions prior to 2.3.1.6, is triggered by a specially crafted ICC profile that causes the function to misinterpret an input buffer as a null-terminated C-string. This leads to out-of-bounds memory access, with AddressSanitizer reporting a read of 115 bytes past a 114-byte heap allocation. The issue was observed while using the 'iccToXml' tool.
Users can update to version 2.3.1.6, where this vulnerability has been patched. Instructions for updating via NPM, Homebrew, Docker, and NixOS are available in the advisory.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/InternationalColorConsortium/iccDEV/issues/734 | [email protected] | ExploitIssue TrackingPatch |
| https://github.com/InternationalColorConsortium/iccDEV/pull/740 | [email protected] | Issue TrackingPatch |
| https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-p9wm-xfv4-43qg | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| color iccdev | < 2.3.1.6 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | Initial Analysis | [email protected] |
| Mar 31, 2026 | New CVE Received | [email protected] |