CVE-2026-22255: iccDEV has heap-buffer-overflow in CIccCLUT::Init() at IccProfLib/IccTagLut.cpp

Vulnerability summary

CVE-2026-22255 is a high (CVSS 8.8) Improper Input Validation vulnerability in color iccdev. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 08-01-2026
   PublishedVulnerability first disclosed.
2. 08-01-2026
   Last modifiedVulnerability information updated.

Description

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a heap-buffer-overflow vulnerability in `CIccCLUT::Init()` at `IccProfLib/IccTagLut.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-130Improper Handling of Length Parameter InconsistencyThe product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
• CWE-252Unchecked Return ValueThe product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.