InternationalColorConsortium iccDEV up to 2.3.1.4 iccFromCube.cpp integer overflow

Summaryinfo

A vulnerability classified as problematic has been found in InternationalColorConsortium iccDEV up to 2.3.1.4. This affects an unknown function of the file iccFromCube.cpp. This manipulation causes integer overflow. This vulnerability appears as CVE-2026-27691. The attack may be initiated remotely. There is no available exploit. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability has been found in InternationalColorConsortium iccDEV up to 2.3.1.4 and classified as problematic. Affected by this vulnerability is some unknown processing of the file iccFromCube.cpp. The manipulation with an unknown input leads to a integer overflow vulnerability. The CWE definition for the vulnerability is CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. As an impact it is known to affect availability. The summary by CVE is:

iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, signed integer overflow in iccFromCube.cpp during multiplication triggers undefined behavior, potentially causing crashes or incorrect ICC profile generation when processing crafted/large cube inputs. Commit 43ae18dd69fc70190d3632a18a3af2f3da1e052a fixes the issue. No known workarounds are available.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-27691 since 02/23/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Applying the patch 43ae18dd69fc70190d3632a18a3af2f3da1e052a is able to eliminate this problem.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• InternationalColorConsortium

Name

• iccDEV

Version

• 2.3.1.0
• 2.3.1.1
• 2.3.1.2
• 2.3.1.3
• 2.3.1.4

Website

• Product: https://github.com/InternationalColorConsortium/iccDEV/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion