CVE-2026-34549
MEDIUM
6,2
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high
Description
AI Translation Available
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is an Undefined Behavior (UB) condition in IccUtil.cpp triggered by a crafted input profile. Under UndefinedBehaviorSanitizer, the issue is reported as invalid left shift operations on icUInt32Number (unsigned 32-bit) where the shifted value “cannot be represented” in that type. This issue has been patched in version 2.3.1.6.
758
Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
IncompleteCommon Consequences
Security Scopes Affected:
Other
Potential Impacts:
Reduce Maintainability
Unexpected State
Quality Degradation
Applicable Platforms
All platforms may be affected
https://github.com/InternationalColorConsortium/iccDEV/issues/721
https://github.com/InternationalColorConsortium/iccDEV/pull/726
https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA…