CVE-2026-24856
BaseFortify
Publication date: 2026-01-28
Last updated on: 2026-02-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| color | iccdev | to 2.3.1.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-681 | When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur. |
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
| CWE-704 | The product does not correctly convert an object, resource, or structure from one type to a different type. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in iccDEV versions prior to 2.3.1.2 where floating-point NaN values are converted to unsigned short integers during ICC profile XML parsing. This causes undefined behavior that can corrupt memory structures and potentially allow arbitrary code execution. It arises from unsafe handling of user-controllable input in ICC profile data.
How can this vulnerability impact me? :
If you use the iccDEV library to process ICC color profiles, this vulnerability could allow an attacker to execute arbitrary code on your system by exploiting memory corruption. This could lead to system compromise, data loss, or other malicious actions.
What immediate steps should I take to mitigate this vulnerability?
Upgrade the iccDEV library to version 2.3.1.2 or later, as this version contains the fix for the vulnerability. No known workarounds are available.