InternationalColorConsortium iccDEV up to 2.3.1.5 ICC Color Profile CIccOpDefEnvVar::Exec reliance on undefined, unspecified, or implementation-defined behavior

Summaryinfo

A vulnerability was found in InternationalColorConsortium iccDEV. It has been rated as problematic. This affects the function CIccOpDefEnvVar::Exec of the component ICC Color Profile Handler. This manipulation causes reliance on undefined, unspecified, or implementation-defined behavior. This vulnerability is handled as CVE-2026-34537. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in InternationalColorConsortium iccDEV. It has been declared as problematic. Affected by this vulnerability is the function CIccOpDefEnvVar::Exec of the component ICC Color Profile Handler. The manipulation with an unknown input leads to a reliance on undefined, unspecified, or implementation-defined behavior vulnerability. The CWE definition for the vulnerability is CWE-758. The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity. As an impact it is known to affect availability. The summary by CVE is:

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger Undefined Behavior (UB) in CIccOpDefEnvVar::Exec() due to invalid enum values being loaded for icSigCmmEnvVar. The issue is observable under UBSan as a “load of value … not a valid value for type icSigCmmEnvVar”, indicating an invalid enum/type value being consumed during ICC profile processing. This issue has been patched in version 2.3.1.6.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-34537 since 03/30/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 2.3.1.6 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• InternationalColorConsortium

Name

• iccDEV

Version

• 2.3.1.1
• 2.3.1.2
• 2.3.1.3
• 2.3.1.4
• 2.3.1.5

Website

• Product: https://github.com/InternationalColorConsortium/iccDEV/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion