CVE-2026-34548
Undefined Behavior in iccDEV iccToXml Causes Data Corruption
Publication date: 2026-03-31
Last updated on: 2026-04-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| color | iccdev | to 2.3.1.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-681 | When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in iccDEV, a set of libraries and tools for working with ICC color management profiles. Before version 2.3.1.6, there is an Undefined Behavior (UB) condition in the XML conversion tool called iccToXml. The issue arises due to an implicit conversion from a negative signed integer to an unsigned 32-bit integer (icUInt32Number), which changes the value unexpectedly. This can cause unpredictable behavior in the software.
How can this vulnerability impact me? :
The vulnerability can lead to undefined behavior in the affected software, which may cause crashes or other disruptions. According to the CVSS score (6.2), the impact is primarily on availability (A:H), meaning it can cause denial of service or make the software unavailable. There is no impact on confidentiality or integrity.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability does not impact confidentiality or integrity of data, only availability. Therefore, it is unlikely to directly affect compliance with standards and regulations such as GDPR or HIPAA, which primarily focus on protecting personal data confidentiality and integrity.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade iccDEV to version 2.3.1.6 or later, where the issue has been patched.