CVE-2026-34537 in InternationalColorConsortium iccDEV
Résumé (Anglaise)
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger Undefined Behavior (UB) in CIccOpDefEnvVar::Exec() due to invalid enum values being loaded for icSigCmmEnvVar. The issue is observable under UBSan as a “load of value … not a valid value for type icSigCmmEnvVar”, indicating an invalid enum/type value being consumed during ICC profile processing. This issue has been patched in version 2.3.1.6.
Responsable
GitHub_M
Réserver
30/03/2026
Divulgation
01/04/2026
Entrées
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnérabilité | CWE | Exp | Con | CVE |
|---|---|---|---|---|---|
| 354571 | InternationalColorConsortium iccDEV ICC Color Profile Exec déni de service | 758 | Non défini | Correctif officiel | CVE-2026-34537 |