{"id":"CVE-2026-24852","summary":"iccDEV has a heap-buffer-overflow in icXmlParseTextString()","details":"iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, a heap buffer over-read when the strlen() function attempts to read a non-null-terminated buffer potentially leaking heap memory contents and causing application termination. This vulnerability affects users of the iccDEV library who process ICC color profiles. ICC Profile Injection vulnerabilities arise when user-controllable input is incorporated into ICC profile data or other structured binary blobs in an unsafe manner. Version 2.3.1.2 contains a fix for the issue. No known workarounds are available.","aliases":["GHSA-q8g2-mp32-3j7f"],"modified":"2026-08-12T15:31:51.164757Z","published":"2026-01-28T00:27:11.575Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-122","CWE-125","CWE-170"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24852.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24852.json"},{"type":"ADVISORY","url":"https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-q8g2-mp32-3j7f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24852"},{"type":"FIX","url":"https://github.com/InternationalColorConsortium/iccDEV/commit/3092499cd4d0775f4a716b999899f9c26f9bc614"},{"type":"FIX","url":"https://github.com/InternationalColorConsortium/iccDEV/pull/540"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/internationalcolorconsortium/iccdev","events":[{"introduced":"0"},{"fixed":"ad159eb00bf46fa17496a0f8c4cb49de8918062c"},{"fixed":"3092499cd4d0775f4a716b999899f9c26f9bc614"}],"database_specific":{"cpe":"cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"2.3.1.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v2.3.1.2","v2.3.1.1","v2.3.1","v2.2.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24852.json","vanir_signatures_modified":"2026-08-12T15:31:51Z","vanir_signatures":[{"deprecated":false,"digest":{"length":739,"function_hash":"264724414749030488316439857453456601275"},"id":"CVE-2026-24852-06e03453","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/3092499cd4d0775f4a716b999899f9c26f9bc614","target":{"file":"IccXML/IccLibXML/IccTagXml.cpp","function":"CIccTagXmlZipXml::ParseXml"}},{"source":"https://github.com/internationalcolorconsortium/iccdev/commit/3092499cd4d0775f4a716b999899f9c26f9bc614","target":{"function":"CIccTagXmlTextDescription::ParseXml","file":"IccXML/IccLibXML/IccTagXml.cpp"},"deprecated":false,"digest":{"function_hash":"156378534927558097634963478515899103146","length":3110},"id":"CVE-2026-24852-7266b013","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/3092499cd4d0775f4a716b999899f9c26f9bc614","target":{"file":"IccXML/IccLibXML/IccTagXml.cpp","function":"CIccTagXmlUtf8Text::ParseXml"},"deprecated":false,"digest":{"function_hash":"139808388030942749331949901926902940356","length":212},"id":"CVE-2026-24852-82116a6a","signature_type":"Function"},{"source":"https://github.com/internationalcolorconsortium/iccdev/commit/3092499cd4d0775f4a716b999899f9c26f9bc614","target":{"file":"IccProfLib/IccConvertUTF.h"},"deprecated":false,"digest":{"line_hashes":["105137370549870132694949354584372482121","291597223585205684246233762224992881801","321937963410617366505448411902154987815","220882953418580220134239117296067978034"],"threshold":0.9},"id":"CVE-2026-24852-8e82a27f","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"214141581418395320956518315178868370488","length":213},"id":"CVE-2026-24852-8f0f694f","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/3092499cd4d0775f4a716b999899f9c26f9bc614","target":{"file":"IccXML/IccLibXML/IccTagXml.cpp","function":"CIccTagXmlUtf16Text::ParseXml"}},{"source":"https://github.com/internationalcolorconsortium/iccdev/commit/3092499cd4d0775f4a716b999899f9c26f9bc614","target":{"file":"IccXML/IccLibXML/IccTagXml.cpp","function":"icXmlDumpTextData"},"deprecated":false,"digest":{"function_hash":"95055493320227074901358031868161101687","length":488},"id":"CVE-2026-24852-c98659d3","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/3092499cd4d0775f4a716b999899f9c26f9bc614","target":{"function":"CIccTagXmlText::ParseXml","file":"IccXML/IccLibXML/IccTagXml.cpp"},"deprecated":false,"digest":{"length":200,"function_hash":"227761687587368504593953223477382067620"},"id":"CVE-2026-24852-cb37b50c","signature_type":"Function"},{"source":"https://github.com/internationalcolorconsortium/iccdev/commit/3092499cd4d0775f4a716b999899f9c26f9bc614","target":{"file":"IccXML/IccLibXML/IccTagXml.cpp"},"deprecated":false,"digest":{"line_hashes":["63153876123371340959621883953256882648","61808985980595203980682871677888162199","322946110483876720075890074148997569342","98454674146142010501314857793887293758","39696315415117178019141091864738205589","32623034832340538303462165956601574828","162881468537949949142496067819966696514","142551866784534663128611778446305684726","336007684126277980337148351215528038482","204377541451331620960984227411855760841","12876949226124719608384390677245253949","107479571999992525124961014840385275131","127245058166361513937692343642234629928","263100875898334969485532527994195096865","249774306550339594822679623745554817035","30807602031580331873283531028058567675","216031790706061519543058853719678044135","64088605960102624247789923859516970369","160686092617844026089189222537918337303","73994404672602956605305079156597609601","95592446929968216257266411293434309152","274502658261170208350200258728477573869","188937893171389033341170004880905583363","29120451903970741226624680640525709526","268449323337934079878259379722194853173","120507882704172629159117123244618275856","167037381308093962053343516688924298427","262877827003022017280819425253390588128","148358783576428421299446929792608177182","147024653084838756728431955948691778623","217207612349460939780806598722188284168","326257142737806779070852749473124667188","195705736127826662948427225422141340515","231284600527991882711059856756505159784","152724093911813182758353654480137521374","99590628399823193047015584615847714918","178997893865641383734592611070340243070","65723678661512368073904806422410897376","172466558722387044231188438028545261588","29528748290477165462553076310337145204","76798100005803671496633600839629376634","108041044330299210300406922099013021209","290475528299489304915775688026014512843","25112729441923012953856403725354437301","51614419027498998753686269215000887241","164796557619214078430396761146844412955","119258988697698457769296765622298402469","307450407335146397132934144922228434129","103852484051360823108410796406162863751","226031748527109818848948259737434902683","325127459459553731783002239329085307879","98275782862643775450742574219438850246","81054441788397709184816486293258154029","51614419027498998753686269215000887241","164796557619214078430396761146844412955","119258988697698457769296765622298402469","197649492021852013576870706687949113380","125292409530386896913309834149002315053","303560396336937787870274946674881838259","5224810046583127603734589975205821263","118524425107026294702227181532296158554","202619667640304364201013251725709837894","247184473577684565515543834468332735693","303560396336937787870274946674881838259","5224810046583127603734589975205821263","118524425107026294702227181532296158554","329296386204040335304988797748360094439","299932516723032958855469461871417810881","76575971103316344321385867732293040173","93059805792138812888441687459019927912","98275782862643775450742574219438850246","81054441788397709184816486293258154029","51614419027498998753686269215000887241","164796557619214078430396761146844412955","119258988697698457769296765622298402469","272433894584969928163960967299257130253","146664142606460255518419669541929830353","121560268423078504738103852829646871294","245581932098429895416996973628528868850","201950977164347469295664744804858812645","171445825389002508955823050186243949780"],"threshold":0.9},"id":"CVE-2026-24852-cd29c80f","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-24852-d25e0f03","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/3092499cd4d0775f4a716b999899f9c26f9bc614","target":{"file":"IccXML/IccLibXML/IccTagXml.cpp","function":"CIccTagXmlZipUtf8Text::ParseXml"},"deprecated":false,"digest":{"function_hash":"246945868835153386660676043545406883207","length":744}},{"target":{"file":"IccXML/IccLibXML/IccTagXml.cpp","function":"icXmlParseTextString"},"deprecated":false,"digest":{"function_hash":"233097417957632985959409446896797279199","length":1653},"id":"CVE-2026-24852-e968bcb2","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/3092499cd4d0775f4a716b999899f9c26f9bc614"},{"digest":{"threshold":0.9,"line_hashes":["288977702706666710256195377882435533949","51674420815263957841896712207645621523","322028666121245626172653580169052849445"]},"id":"CVE-2026-24852-f606076a","signature_type":"Line","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/3092499cd4d0775f4a716b999899f9c26f9bc614","target":{"file":"IccProfLib/IccConvertUTF.cpp"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"}]}