iccDEV has Heap Buffer Overflow in icCurvesFromXml()
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.6%
exploitation probability
0.6%top 52% of all CVEs
observed exploitation
nono source reports it
In short
iccDEV has a memory safety flaw where specially crafted ICC color profile files can overflow a buffer, potentially crashing the application or allowing an attacker to execute malicious code.
Technical detail
Heap buffer overflow in CIccTagXmlSegmentedCurve::ToXml() due to insufficient input validation (CWE-122, CWE-20) when processing user-supplied ICC profile data; exploitation requires a malformed profile file and can result in denial of service, data corruption, or arbitrary code execution.
Summary generated and translated by AI from the official description.
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have aHeap Buffer Overflow vulnerability in the CIccTagXmlSegmentedCurve::ToXml() function. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
InternationalColorConsortium · iccDEV