Null-Pointer Dereference Vulnerability in iccDEV Libraries
CVE-2026-34551

6.2MEDIUM

Key Information:

Vendor

Internationalcolorconsortium

Status
Iccdev
Vendor
CVE Published:
31 March 2026

What is CVE-2026-34551?

The iccDEV library, utilized for handling ICC color management profiles, experienced a Null-Pointer Dereference vulnerability in its CIccTagLut16::Write() function. This flaw can be exploited when processing specially crafted ICC profiles embedded within TIFF files, potentially leading to unexpected behavior or crashes during execution. It is recommended that users upgrade to version 2.3.1.6 or later to mitigate this risk. For further details, refer to the security advisory.

Affected Version(s)

iccDEV < 2.3.1.6

References

https://github.com/InternationalColorConsortium/iccDEV/se...
x_refsource_CONFIRM
https://github.com/InternationalColorConsortium/iccDEV/is...
x_refsource_MISC
https://github.com/InternationalColorConsortium/iccDEV/pu...
x_refsource_MISC

CVSS V3.1

Score:
6.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.