CVE-2026-34554 in InternationalColorConsortium iccDEV

Summary

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a heap-buffer-overflow (HBO) in CIccApplyCmmSearch::costFunc() can be triggered via malformed JSON configuration input to the iccApplySearch tool. AddressSanitizer reports an out-of-bounds READ of size 8 originating from CIccApplyCmmSearch::costFunc(CIccSearchVec&) at IccProfLib/IccCmmSearch.cpp:112:5. This issue has been patched in version 2.3.1.6.

Responsible

GitHub_M

Reservation

03/30/2026

Disclosure

04/01/2026

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
354567	InternationalColorConsortium iccDEV JSON Configuration IccCmmSearch.cpp costFunc out-of-bounds	125	Not defined	Official fix	CVE-2026-34554