CVE-2026-34540 in iccDEV

Resumen (Inglés)

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger a heap-buffer-overflow (HBO) in icMemDump() when iccDumpProfile attempts to dump/describe malformed tag contents. The issue is observable under AddressSanitizer as an out-of-bounds heap read in icMemDump(...) at IccProfLib/IccUtil.cpp:1002, reachable via CIccTagUnknown::Describe(). This issue has been patched in version 2.3.1.6.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Responsable

GitHub_M

Reservar

2026-03-30

Divulgación

2026-04-01

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
354578	InternationalColorConsortium iccDEV ICC Color Profile IccUtil.cpp icMemDump desbordamiento de búfer	122	No está definido	Arreglo oficial	CVE-2026-34540

Fuentes

• MITRE
• NVD
• CVE Details