Undefined Behavior Vulnerability in iccDEV Library from International Color Consortium
CVE-2026-34537

6.2MEDIUM

Key Information:

Vendor: Internationalcolorconsortium
Status: Iccdev
Vendor: CVE Published:; 31 March 2026

🔔 Create Internationalcolorconsortium Vulnerability Alert

What is CVE-2026-34537?

The iccDEV library, utilized for managing ICC color profiles, contains a vulnerability that allows for undefined behavior when processing crafted ICC profiles. This issue arises from the loading of invalid enum values for 'icSigCmmEnvVar' within the CIccOpDefEnvVar::Exec() function. The vulnerability can be observed through Undefined Behavior Sanitizer (UBSan) that triggers a loading error related to invalid enumeration/type values during ICC profile execution. Users are strongly encouraged to upgrade to version 2.3.1.6 or later to avoid potential exploitation of this vulnerability.