CVE-2026-27691
iccDEV has SIO in parse3DTable() at iccFromCube.cpp Line 218
CVSS Score
6.2
EPSS Score
0.0%
EPSS Percentile
0th
iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, signed integer overflow in iccFromCube.cpp during multiplication triggers undefined behavior, potentially causing crashes or incorrect ICC profile generation when processing crafted/large cube inputs. Commit 43ae18dd69fc70190d3632a18a3af2f3da1e052a fixes the issue. No known workarounds are available.
| CWE | CWE-190 CWE-681 |
| Vendor | internationalcolorconsortium |
| Product | iccdev |
| Published | Feb 25, 2026 |
| Last Updated | Feb 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for internationalcolorconsortium iccdev
Be the first to know when new medium vulnerabilities affecting internationalcolorconsortium iccdev are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
InternationalColorConsortium / iccDEV
<= 2.3.1.4
References
github.com: https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-4gfj-4cjh-53v5 github.com: https://github.com/InternationalColorConsortium/iccDEV/issues/607 github.com: https://github.com/InternationalColorConsortium/iccDEV/pull/611 github.com: https://github.com/InternationalColorConsortium/iccDEV/commit/43ae18dd69fc70190d3632a18a3af2f3da1e052a