Division by Zero in iccDEV TIFF Handling Causes Undefined Behavior

Publication date: 2026-03-31

Last updated on: 2026-04-20

Assigner: GitHub, Inc.

Description

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted TIFF input can trigger Undefined Behavior (UB) due to division by zero in the TIFF handling code paths used by iccTiffDump. This issue has been patched in version 2.3.1.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-31

Last Modified

2026-04-20

Generated

2026-07-06

AI Q&A

2026-04-01

EPSS Evaluated

2026-07-05

NVD

CVE-2026-34546

Affected Vendors & Products

Vendor	Product	Version / Range
color	iccdev	to 2.3.1.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-369	The product divides a value by zero.

Attack-Flow Graph

Executive Summary

This vulnerability exists in iccDEV's iccTiffDump tool prior to version 2.3.1.6. It occurs when a specially crafted TIFF file is processed, leading to undefined behavior caused by a division by zero error in the TIFF handling code.

Impact Analysis

The vulnerability can cause a denial of service condition by triggering undefined behavior, which may crash the iccTiffDump tool or cause it to behave unpredictably. This can disrupt workflows that rely on this tool for ICC color profile management.

Mitigation Strategies

To mitigate this vulnerability, update iccTiffDump to version 2.3.1.6 or later, where the issue has been patched.

Hi! I’m here to help you understand CVE-2026-34546. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70