CVE-2026-24852

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-24852
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24852.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-24852
Aliases
  • GHSA-q8g2-mp32-3j7f
Published
2026-01-28T00:27:11.575Z
Modified
2026-07-22T00:51:47.334814Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CVSS Calculator
Summary
iccDEV has a heap-buffer-overflow in icXmlParseTextString()
Details

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, a heap buffer over-read when the strlen() function attempts to read a non-null-terminated buffer potentially leaking heap memory contents and causing application termination. This vulnerability affects users of the iccDEV library who process ICC color profiles. ICC Profile Injection vulnerabilities arise when user-controllable input is incorporated into ICC profile data or other structured binary blobs in an unsafe manner. Version 2.3.1.2 contains a fix for the issue. No known workarounds are available.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-122",
        "CWE-125",
        "CWE-170"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24852.json"
}
References

Affected packages

Git / github.com/internationalcolorconsortium/iccdev

Affected ranges

Type
GIT
Repo
https://github.com/internationalcolorconsortium/iccdev
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ad159eb00bf46fa17496a0f8c4cb49de8918062c
Fixed
3092499cd4d0775f4a716b999899f9c26f9bc614
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.3.1.2"
        }
    ]
}

Affected versions

v2.*
v2.2.6
v2.3.1
v2.3.1.1
v2.3.1.2

Database specific

vanir_signatures_modified 
"2026-07-22T00:51:47Z"
vanir_signatures 
[
    {
        "target": {
            "function": "CIccTagXmlZipXml::ParseXml",
            "file": "IccXML/IccLibXML/IccTagXml.cpp"
        },
        "digest": {
            "length": 739.0,
            "function_hash": "264724414749030488316439857453456601275"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2026-24852-06e03453",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/3092499cd4d0775f4a716b999899f9c26f9bc614"
    },
    {
        "target": {
            "function": "CIccTagXmlTextDescription::ParseXml",
            "file": "IccXML/IccLibXML/IccTagXml.cpp"
        },
        "digest": {
            "length": 3110.0,
            "function_hash": "156378534927558097634963478515899103146"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2026-24852-7266b013",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/3092499cd4d0775f4a716b999899f9c26f9bc614"
    },
    {
        "target": {
            "function": "CIccTagXmlUtf8Text::ParseXml",
            "file": "IccXML/IccLibXML/IccTagXml.cpp"
        },
        "digest": {
            "length": 212.0,
            "function_hash": "139808388030942749331949901926902940356"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2026-24852-82116a6a",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/3092499cd4d0775f4a716b999899f9c26f9bc614"
    },
    {
        "target": {
            "file": "IccProfLib/IccConvertUTF.h"
        },
        "digest": {
            "line_hashes": [
                "105137370549870132694949354584372482121",
                "291597223585205684246233762224992881801",
                "321937963410617366505448411902154987815",
                "220882953418580220134239117296067978034"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2026-24852-8e82a27f",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/3092499cd4d0775f4a716b999899f9c26f9bc614"
    },
    {
        "target": {
            "function": "CIccTagXmlUtf16Text::ParseXml",
            "file": "IccXML/IccLibXML/IccTagXml.cpp"
        },
        "digest": {
            "length": 213.0,
            "function_hash": "214141581418395320956518315178868370488"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2026-24852-8f0f694f",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/3092499cd4d0775f4a716b999899f9c26f9bc614"
    },
    {
        "target": {
            "function": "icXmlDumpTextData",
            "file": "IccXML/IccLibXML/IccTagXml.cpp"
        },
        "digest": {
            "length": 488.0,
            "function_hash": "95055493320227074901358031868161101687"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2026-24852-c98659d3",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/3092499cd4d0775f4a716b999899f9c26f9bc614"
    },
    {
        "target": {
            "function": "CIccTagXmlText::ParseXml",
            "file": "IccXML/IccLibXML/IccTagXml.cpp"
        },
        "digest": {
            "length": 200.0,
            "function_hash": "227761687587368504593953223477382067620"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2026-24852-cb37b50c",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/3092499cd4d0775f4a716b999899f9c26f9bc614"
    },
    {
        "target": {
            "file": "IccXML/IccLibXML/IccTagXml.cpp"
        },
        "digest": {
            "line_hashes": [
                "63153876123371340959621883953256882648",
                "61808985980595203980682871677888162199",
                "322946110483876720075890074148997569342",
                "98454674146142010501314857793887293758",
                "39696315415117178019141091864738205589",
                "32623034832340538303462165956601574828",
                "162881468537949949142496067819966696514",
                "142551866784534663128611778446305684726",
                "336007684126277980337148351215528038482",
                "204377541451331620960984227411855760841",
                "12876949226124719608384390677245253949",
                "107479571999992525124961014840385275131",
                "127245058166361513937692343642234629928",
                "263100875898334969485532527994195096865",
                "249774306550339594822679623745554817035",
                "30807602031580331873283531028058567675",
                "216031790706061519543058853719678044135",
                "64088605960102624247789923859516970369",
                "160686092617844026089189222537918337303",
                "73994404672602956605305079156597609601",
                "95592446929968216257266411293434309152",
                "274502658261170208350200258728477573869",
                "188937893171389033341170004880905583363",
                "29120451903970741226624680640525709526",
                "268449323337934079878259379722194853173",
                "120507882704172629159117123244618275856",
                "167037381308093962053343516688924298427",
                "262877827003022017280819425253390588128",
                "148358783576428421299446929792608177182",
                "147024653084838756728431955948691778623",
                "217207612349460939780806598722188284168",
                "326257142737806779070852749473124667188",
                "195705736127826662948427225422141340515",
                "231284600527991882711059856756505159784",
                "152724093911813182758353654480137521374",
                "99590628399823193047015584615847714918",
                "178997893865641383734592611070340243070",
                "65723678661512368073904806422410897376",
                "172466558722387044231188438028545261588",
                "29528748290477165462553076310337145204",
                "76798100005803671496633600839629376634",
                "108041044330299210300406922099013021209",
                "290475528299489304915775688026014512843",
                "25112729441923012953856403725354437301",
                "51614419027498998753686269215000887241",
                "164796557619214078430396761146844412955",
                "119258988697698457769296765622298402469",
                "307450407335146397132934144922228434129",
                "103852484051360823108410796406162863751",
                "226031748527109818848948259737434902683",
                "325127459459553731783002239329085307879",
                "98275782862643775450742574219438850246",
                "81054441788397709184816486293258154029",
                "51614419027498998753686269215000887241",
                "164796557619214078430396761146844412955",
                "119258988697698457769296765622298402469",
                "197649492021852013576870706687949113380",
                "125292409530386896913309834149002315053",
                "303560396336937787870274946674881838259",
                "5224810046583127603734589975205821263",
                "118524425107026294702227181532296158554",
                "202619667640304364201013251725709837894",
                "247184473577684565515543834468332735693",
                "303560396336937787870274946674881838259",
                "5224810046583127603734589975205821263",
                "118524425107026294702227181532296158554",
                "329296386204040335304988797748360094439",
                "299932516723032958855469461871417810881",
                "76575971103316344321385867732293040173",
                "93059805792138812888441687459019927912",
                "98275782862643775450742574219438850246",
                "81054441788397709184816486293258154029",
                "51614419027498998753686269215000887241",
                "164796557619214078430396761146844412955",
                "119258988697698457769296765622298402469",
                "272433894584969928163960967299257130253",
                "146664142606460255518419669541929830353",
                "121560268423078504738103852829646871294",
                "245581932098429895416996973628528868850",
                "201950977164347469295664744804858812645",
                "171445825389002508955823050186243949780"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2026-24852-cd29c80f",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/3092499cd4d0775f4a716b999899f9c26f9bc614"
    },
    {
        "target": {
            "function": "CIccTagXmlZipUtf8Text::ParseXml",
            "file": "IccXML/IccLibXML/IccTagXml.cpp"
        },
        "digest": {
            "length": 744.0,
            "function_hash": "246945868835153386660676043545406883207"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2026-24852-d25e0f03",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/3092499cd4d0775f4a716b999899f9c26f9bc614"
    },
    {
        "target": {
            "function": "icXmlParseTextString",
            "file": "IccXML/IccLibXML/IccTagXml.cpp"
        },
        "digest": {
            "length": 1653.0,
            "function_hash": "233097417957632985959409446896797279199"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2026-24852-e968bcb2",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/3092499cd4d0775f4a716b999899f9c26f9bc614"
    },
    {
        "target": {
            "file": "IccProfLib/IccConvertUTF.cpp"
        },
        "digest": {
            "line_hashes": [
                "288977702706666710256195377882435533949",
                "51674420815263957841896712207645621523",
                "322028666121245626172653580169052849445"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2026-24852-f606076a",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/3092499cd4d0775f4a716b999899f9c26f9bc614"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24852.json"