Undefined Behavior Vulnerability in ICC Color Management Library by International Color Consortium
CVE-2026-34549

6.2MEDIUM

Key Information:

Vendor: Internationalcolorconsortium
Status: Iccdev
Vendor: CVE Published:; 31 March 2026

🔔 Create Internationalcolorconsortium Vulnerability Alert

What is CVE-2026-34549?

The ICC color management library, iccDEV, previously had a vulnerability that led to Undefined Behavior (UB) due to improper handling of input profiles. This condition, present prior to version 2.3.1.6, allowed for invalid left shift operations on icUInt32Number, potentially causing unpredictable behavior and system instability. The issue was adequately addressed in version 2.3.1.6, with patch notes available in the project's repository.