CVE-2026-24411

CVE-2026-24411 is an Undefined Behavior vulnerability in the iccDEV libraries and tools, which are used for interacting with, manipulating, and applying ICC color management profiles. The issue resides in the CIccTagXmlSegmentedCurve::ToXml() function and affects versions 2.3.1.1 and prior. It arises when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs, leading to potential exploitation. The vulnerability is rated with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) and is associated with CWEs 20 (Improper Input Validation), 476 (NULL Pointer Dereference), 690 (Unchecked Return Value to NULL Pointer Dereference), and 758 ( Reliance on Undefined, Unspecified, or Implementation-Defined Behavior).

Remote attackers with no privileges can exploit this vulnerability over the network with low complexity, but it requires user interaction, such as opening a malicious ICC profile. Successful exploitation could result in denial of service (high availability impact), data manipulation (low integrity impact), bypassing application logic, or even code execution, depending on the context of the affected software processing the profile.

Mitigation is available via an update to iccDEV version 2.3.1.2, as detailed in the project's GitHub security advisory (GHSA-x53f-7h27-9fc8), issue tracker (#499), and the fixing commit (d6d6f51a999d4266ec09347cac7e0930d6e02eec). Security practitioners should advise users of affected applications to apply this patch promptly and validate ICC profiles from untrusted sources.