Heap Use-After-Free Vulnerability in ICC Color Management Tool by International Color Consortium
CVE-2026-30978

7.8HIGH

Key Information:

Vendor: Internationalcolorconsortium
Status: Iccdev
Vendor: CVE Published:; 10 March 2026

🔔 Create Internationalcolorconsortium Vulnerability Alert

What is CVE-2026-30978?

A vulnerability in the ICC color management library, iccDEV, occurs due to a heap use-after-free issue within the CIccCmm::AddXform() function. This flaw leads to an invalid vpointer dereference, which can result in application crashes. Users are encouraged to update to version 2.3.1.5, which rectifies this issue and enhances overall security.