CVE-2026-24406: high-severity vulnerability in InternationalColorConsortium iccDEV
iccDEV has Heap Buffer Overflow in CIccTagNamedColor2::SetSize()
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
iccDEV's color profile library has a memory overflow flaw in its NamedColor2 tag handler. When processing specially crafted color profiles, attackers can crash the application, corrupt data, or potentially run malicious code.
A heap buffer overflow exists in CIccTagNamedColor2::SetSize() where unsanitized user input from ICC profile structures is written beyond allocated memory boundaries. The vulnerability allows remote exploitation via malicious ICC files, potentially enabling denial of service, data manipulation, logic bypass, and arbitrary code execution on affected versions ≤2.3.1.1.
In the same product, most dangerous first.