CVE-2026-27692: color iccdev Out-of-bounds Read

Vulnerability summary

CVE-2026-27692 is a high (CVSS 7.1) Out-of-bounds Read vulnerability in color iccdev. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 25-02-2026
   PublishedVulnerability first disclosed.
2. 25-02-2026
   Last modifiedVulnerability information updated.

Description

iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, heap-buffer-overflow read occurs during CIccTagTextDescription::Release() when strlen() reads past a heap buffer while parsing ICC profile XML text description tags, causing a crash. Commit 29d088840b962a7cdd35993dfabc2cb35a049847 fixes the issue. No known workarounds are available.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
• CWE-170Improper Null TerminationThe product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.