Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Versions prior to 2.3.1.2 have an undefined behavior issue when floating-point NaN values are converted to unsigned short integer types during ICC profile XML parsing potentially corrupting memory structures and enabling arbitrary code execution. This vulnerability affects users of the iccDEV library who process ICC color profiles. ICC Profile Injection vulnerabilities arise when user-controllable input is incorporated into ICC profile data or other structured binary blobs in an unsafe manner. Version 2.3.1.2 contains a fix for the issue. No known workarounds are available.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-24856 Memory Corruption in iccDEV Library via Unsafe ICC Profile XML Parsing https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-24856
Post summary
A memory corruption vulnerability (CVE-2026-24856) has been identified in the iccDEV Library due to unsafe parsing of ICC profile XML files.
CVE-2026-24856 iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Versions prior to 2.3.1.2… https://www.cve.org/CVERecord?id=CVE-2026-24856
Post summary
The text highlights CVE-2026-24856 and notes that versions prior to 2.3.1.2 are affected, but offers no details on proof‑of‑concepts, exploitation, patches, or active attacks.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | color | iccdev | - | - | - |