Description

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions prior to 2.3.2.1 have a `CIccEmbedIO::Read8()` size_t underflow. The issue arises due to an embedded-profile read defect when parsing ICC profiles containing `icSigEmbeddedV5ProfileTag` data with `icSigEmbeddedProfileType` payloads. Version 2.3.2.1 patches the issue. No known workarounds are available.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-21T15:16:41.603Z",
  "pubdate": "2026-08-21T15:16:41.603Z",
  "executiveSummary": "A size_t underflow vulnerability exists in the `CIccEmbedIO::Read8()` function of iccDEV libraries and tools, specifically when parsing ICC color management profiles prior to version 2.3.2.1.\nThe security defect is triggered during the processing of ICC profiles containing specifically crafted `icSigEmbeddedV5ProfileTag` data paired with `icSigEmbeddedProfileType` payloads.\nSuccessful exploitation of this flaw can lead to memory corruption, potentially resulting in application crashes or arbitrary code execution within the context of the running process parsing the malformed profile.\nThe vulnerability poses a risk to systems processing untrusted ICC color profiles, as an attacker can supply a malicious profile via files or network streams.\nNo known workarounds are available to mitigate the issue without applying the official software update.\nResolution requires upgrading the affected iccDEV libraries and tools to version 2.3.2.1 or later, where the patch has been implemented.",
  "technicalDetails": "The vulnerability resides within the `CIccEmbedIO::Read8()` function utilized by iccDEV for handling embedded input/output operations in ICC color management profiles.\nThe root cause of the vulnerability is a size_t underflow condition that occurs during profile parsing operations.\nSpecifically, the flaw manifests when the parser evaluates ICC profiles containing `icSigEmbeddedV5ProfileTag` data structures that incorporate `icSigEmbeddedProfileType` payloads.\nDue to inadequate validation and handling of size calculations within the parsing logic, arithmetic operations on `size_t` variables underflow, resulting in unintended wrap-around values.\nThe attack flow begins when an application utilizing vulnerable versions of iccDEV attempts to parse a maliciously crafted ICC color profile supplied by an untrusted source.\nAs the parsing engine processes the `icSigEmbeddedV5ProfileTag` containing the `icSigEmbeddedProfileType` payload, the vulnerable `CIccEmbedIO::Read8()` function computes an incorrect buffer size or offset due to the size_t underflow.\nThis incorrect size calculation subsequently leads to memory corruption, such as out-of-bounds read or write conditions, when data is read into or read from memory buffers.\nThe vulnerable component comprises the core ICC profile parsing and embedded I/O handling logic within iccDEV versions prior to 2.3.2.1.\nExploitation does not require authentication or specific privilege levels, relying entirely on the victim application processing a malformed ICC profile provided by the attacker.\nDepending on the memory layout and architecture, successful exploitation can cause denial of service via application termination or potentially enable arbitrary code execution.\nAffected software includes all iccDEV libraries and tools versions prior to 2.3.2.1."
}