CVE-2026-34555

Medium CVSS: 6.2

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a stack-buffer-overflow (SBO) in CIccTagFixedNum<>::GetValues() and a related bug chain. The primary crash is an AddressSanitizer-reported WRITE of size 4 that overflows a 4-byte stack variable (rv) via the call chain CIccTagFixedNum::GetValues() -> CIccTagStruct::GetElemNumberValue(). This issue has been patched in version 2.3.1.6.

Vendor

Product

CWE

CWE-121

Yayın Tarihi

2026-03-31 23:17:10

Güncelleme

2026-04-01 14:23:37

Source Identifier

security-advisories@github.com

KEV Date Added

Kategoriler

CWE-121 MEDIUM 2026

Referanslar

https://github.com/InternationalColorConsortium/iccDEV/issues/696 https://github.com/InternationalColorConsortium/iccDEV/issues/697 https://github.com/InternationalColorConsortium/iccDEV/issues/698 https://github.com/InternationalColorConsortium/iccDEV/issues/703 https://github.com/InternationalColorConsortium/iccDEV/pull/739 https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-983c-rgh5-4982 https://github.com/InternationalColorConsortium/iccDEV/issues/696