CVE-2026-34541
Received Received - Intake
Null Pointer Dereference in iccDEV ICC Profile Processing Causes UB

Publication date: 2026-03-31

Last updated on: 2026-04-20

Assigner: GitHub, Inc.

Description
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger Undefined Behavior (UB) via a null-pointer member call in CIccCombinedConnectionConditions::CIccCombinedConnectionConditions() (reported by UBSan as “member call on null pointer of type CIccTagSpectralViewingConditions”). The issue is reachable when running iccApplyNamedCmm with -PCC using a malformed .icc profile. This issue has been patched in version 2.3.1.6.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-31
Last Modified
2026-04-20
Generated
2026-06-16
AI Q&A
2026-04-01
EPSS Evaluated
2026-06-15
NVD
CVE-2026-34541
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
color iccdev to 2.3.1.6 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in iccDEV, a set of libraries and tools for working with ICC color management profiles. Before version 2.3.1.6, a specially crafted ICC profile can cause undefined behavior due to a null-pointer member call in the constructor of CIccCombinedConnectionConditions. This happens when running the iccApplyNamedCmm tool with the -PCC option using a malformed ICC profile.

Impact Analysis

The vulnerability can lead to undefined behavior, which may cause the application to crash or behave unpredictably. According to the CVSS score, it has a high impact on availability (score 6.2 with an impact on availability only), meaning it could cause denial of service or disruption of normal operations when processing malicious ICC profiles.

Mitigation Strategies

To mitigate this vulnerability, update iccDEV to version 2.3.1.6 or later, where the issue has been patched.

Avoid running iccApplyNamedCmm with the -PCC option on untrusted or malformed ICC profiles until the update is applied.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-34541. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart