CVE-2026-22861: iccDEV has a heap-buffer-overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cpp

Vulnerability summary

CVE-2026-22861 is a high (CVSS 8.8) Classic Buffer Overflow vulnerability in color iccdev. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 52.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 13-01-2026
   PublishedVulnerability first disclosed.
2. 13-01-2026
   Last modifiedVulnerability information updated.

Description

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Prior to 2.3.1.2, There is a heap-based buffer overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cpp. This vulnerability affects users of the iccDEV library who process ICC color profiles. The vulnerability is fixed in 2.3.1.2.

• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
• CWE-130Improper Handling of Length Parameter InconsistencyThe product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
• CWE-252Unchecked Return ValueThe product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.