Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, a heap buffer over-read when the strlen() function attempts to read a non-null-terminated buffer potentially leaking heap memory contents and causing application termination. This vulnerability affects users of the iccDEV library who process ICC color profiles. ICC Profile Injection vulnerabilities arise when user-controllable input is incorporated into ICC profile data or other structured binary blobs in an unsafe manner. Version 2.3.1.2 contains a fix for the issue. No known workarounds are available.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-24852 Heap Buffer Over-Read Vulnerability in iccDEV Library Before 2.3.1.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-24852
Post summary
A heap buffer over-read vulnerability (CVE-2026-24852) was disclosed for iccDEV Library versions prior to 2.3.1.2, but no PoC, exploit, patch, or evidence of active exploitation is provided.
CVE-2026-24852 iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2,… https://www.cve.org/CVERecord?id=CVE-2026-24852
Post summary
A brief disclosure of CVE-2026-24852 notes that the vulnerability exists in older iccDEV libraries before v2.3.1.2, implying a patch is available in that newer version.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | color | iccdev | - | - | - |