Undefined Behavior in iccDEV Library Versions Prior to 2.3.1.2
CVE-2026-24856

7.8HIGH

Key Information:

Vendor: Internationalcolorconsortium
Status: Iccdev
Vendor: CVE Published:; 28 January 2026

🔔 Create Internationalcolorconsortium Vulnerability Alert

What is CVE-2026-24856?

The iccDEV library, designed for ICC color management profile interactions, has a critical vulnerability in versions before 2.3.1.2. This issue arises from improper handling of floating-point NaN values during the parsing of ICC profile XML files, leading to potential memory corruption. Attackers can exploit this by injecting malicious ICC profile data, resulting in the possibility of arbitrary code execution. Users of the iccDEV library are strongly advised to update to the latest version, as there are no known workarounds for this vulnerability.