CVE-2026-24404

iccDEV has Null Pointer Deference and Undefined Behavior in CIccXmlArrayType()

State: Published
Severity: 7.1 High
Published: Jan 24, 2026
Updated: Jan 26, 2026
Reserved: Jan 22, 2026

Description

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In versions 2.3.1.1 and below, CIccXmlArrayType() contains a Null Pointer Dereference and Undefined Behavior vulnerability. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H	GitHub_M

Weaknesses

CWE-20 Improper Input Validation
CWE-476 NULL Pointer Dereference
CWE-690 Unchecked Return Value to NULL Pointer Dereference
CWE-758 Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

Affected Products

Product	Versions
iccDEVInternationalColorConsortium	< 2.3.1.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.