{"id":"CVE-2026-50278","summary":"iccDEV: CIccEmbedIO::Read8() size_t underflow","details":"iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions prior to 2.3.2.1 have a `CIccEmbedIO::Read8()` size_t underflow. The issue arises due to an embedded-profile read defect when parsing ICC profiles containing `icSigEmbeddedV5ProfileTag` data with `icSigEmbeddedProfileType` payloads. Version 2.3.2.1 patches the issue. No known workarounds are available.","aliases":["GHSA-7qjg-7qq4-c77j"],"modified":"2026-08-24T03:59:15.267871Z","published":"2026-08-21T14:57:10.283Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-125","CWE-190","CWE-704"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50278.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50278.json"},{"type":"ADVISORY","url":"https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-7qjg-7qq4-c77j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50278"},{"type":"REPORT","url":"https://github.com/InternationalColorConsortium/iccDEV/issues/987"},{"type":"FIX","url":"https://github.com/InternationalColorConsortium/iccDEV/commit/002d1108c1bd674de0ac1b0abfa0162986f19086"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/internationalcolorconsortium/iccdev","events":[{"introduced":"0"},{"fixed":"002d1108c1bd674de0ac1b0abfa0162986f19086"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"2.3.2.1"}]}}],"versions":["ci-latest-26607510799-1","ci-latest-26554726170-1","ci-latest-26544249949-1","ci-latest-26489445300-1","ci-latest-26428850184-1","ci-latest-26313504966-1","ci-latest-26222346429-1","ci-latest-26200960412-1","ci-latest-26136588125-1","ci-latest-26129815372-1","v2.3.2.0","v2.3.1.8","v2.3.1.7","latest","v2.3.1.6","wasm-v2.3.5","v2.3.1.5","v2.3.1.4","v2.3.1.3","v2.3.1.2","v2.3.1.1","v2.3.1","v2.2.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50278.json","vanir_signatures_modified":"2026-08-24T03:59:15Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"178431802332780065501832873379291410175","length":639},"id":"CVE-2026-50278-09fe5efa","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"function":"CIccXformNDLut::ExtractInputCurves","file":"IccProfLib/IccCmm.cpp"}},{"signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccTagBasic.cpp"},"deprecated":false,"digest":{"line_hashes":["60251288574492440133267259557573999591","228443173623573166678587549642387398735","70958398901877983953100978811264535127","83789504517492546484841807366134485527","194320941637363344524635194936847232187","131531002372268761628947670919241781745","38960896295107333925415702120900222885","106317692085916804088580386594173259699","103052601586766081784619541525960645937","181994917393719038250727983582001512547","177250019184477855716338155913010050870","225499220997193142539467215807173592093","49537142772626388835829136610275175454","63155364135334040103534348356096317376","234152073998153661002779560320202458786","137062074097920106059069540868778925856","212592356318940551568913856396011220486","9093987813800026561778772195869544891","198398733736492543801407857785648974999","332070225450859839327334712717209521288","233812826135957873531508501906691412935","182900039857806280482928098828014883642","196751188115267127041450730239463721232","114994959023216383302476059198952835473","29359590568805564045453113552584315586","194320941637363344524635194936847232187","212530290303346282214139502800828513746","96489157487439835816923861079287245059"],"threshold":0.9},"id":"CVE-2026-50278-1008516f","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccCmm.cpp","function":"CIccXform3DLut::ExtractOutputCurves"},"deprecated":false,"digest":{"function_hash":"81373656187128898699580245158112335592","length":646},"id":"CVE-2026-50278-103896e6"},{"source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccTagBasic.cpp","function":"operator="},"deprecated":false,"digest":{"function_hash":"273825078567387187568017282448930671746","length":77},"id":"CVE-2026-50278-1a7ea4ae","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["210491269979316098436107981960318483767","315298204073836642542619683133499601357","120306284712401519976676941057171161525","280366181052002208686543834894762951681","313174494380348661815716207546647101786"]},"id":"CVE-2026-50278-29cfcdfe","signature_type":"Line","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"Tools/CmdLine/IccApplyNamedCmm/iccApplyNamedCmm.cpp"}},{"target":{"file":"Tools/CmdLine/IccDumpProfile/iccDumpProfile.cpp"},"deprecated":false,"digest":{"line_hashes":["130590310813887342163290415512395135867","113144482959593493535698797304815303576","243163307508259142242426836994510738459","130044818208269795878623441906445463736","16078911479307799571730624359247702228","309401002492145211190943475624775860091","186894520166725685184817123413243776075","337045716926724285454194626194106029692","160387484906592977504493000864152786869","163552544670937195411646514322337203886","58211760502733299494420402844715030670","158187962360607051282062930953289564945"],"threshold":0.9},"id":"CVE-2026-50278-2e65a911","signature_type":"Line","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086"},{"id":"CVE-2026-50278-2eeb4daf","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"Tools/CmdLine/IccApplySearch/iccApplySearch.cpp","function":"main"},"deprecated":false,"digest":{"length":6360,"function_hash":"305256754653175052274707407514874684504"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccTagBasic.cpp","function":"operator="},"deprecated":false,"digest":{"function_hash":"38554394264403071820734173424414040792","length":89},"id":"CVE-2026-50278-313f28d2"},{"deprecated":false,"digest":{"function_hash":"266373297371444732227793835621222875356","length":112},"id":"CVE-2026-50278-3cea7fba","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccTagBasic.h","function":"operator="}},{"target":{"function":"CIccXformNDLut::ExtractOutputCurves","file":"IccProfLib/IccCmm.cpp"},"deprecated":false,"digest":{"function_hash":"76135790748280638822824996298355217549","length":646},"id":"CVE-2026-50278-3fbcd70b","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086"},{"deprecated":false,"digest":{"line_hashes":["243072436741936335078448626197061686496","336344361674852652280702734706596424359","112212962175635023729551090554005616882","334151582763974167167624455034375200198"],"threshold":0.9},"id":"CVE-2026-50278-40c42e75","signature_type":"Line","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccMpeCalc.h"}},{"digest":{"line_hashes":["141181305267546196235387025500784049050","105569371043684893131493728445390820363","328241645101787155506193758791895745437","56731930098416906445342605313165589311","94814306589463233062523007092329122093","241480668877333832505850074611472548096","227587176292432634732738229806632522976","105202757881280060754388165669688328101","16314529453223603136021002382825334012","289867378714512824678726290819734842897","191765981515971108826632363578759031219","241912168238033650793777173725794011331"],"threshold":0.9},"id":"CVE-2026-50278-43cb1db6","signature_type":"Line","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"Tools/CmdLine/IccFromCube/iccFromCube.cpp"},"deprecated":false},{"source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"function":"CIccXformMpe::Create","file":"IccProfLib/IccCmm.cpp"},"deprecated":false,"digest":{"function_hash":"69691553131739742204099193757789644437","length":4203},"id":"CVE-2026-50278-45353e03","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-50278-4a01b1c0","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccCmm.cpp","function":"CIccXform4DLut::ExtractOutputCurves"},"deprecated":false,"digest":{"function_hash":"295481858552423792032876378510069679382","length":646}},{"digest":{"function_hash":"273825078567387187568017282448930671746","length":77},"id":"CVE-2026-50278-521d633e","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccTagBasic.cpp","function":"operator="},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["31632592859954513916366261927215914989","268639445246998364023889981198625519260","111606065834482459540908090571837093435","186351389509524486546701166165208484063","174616359417409185646077687104676909932","100037314869119603263517020595361502423","282785447031251392998255199713761678488","29217398664478749554702419989755654291"],"threshold":0.9},"id":"CVE-2026-50278-566cff83","signature_type":"Line","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccArrayFactory.cpp"}},{"deprecated":false,"digest":{"function_hash":"39329825883555646601353756545599884946","length":1693},"id":"CVE-2026-50278-5e99b80f","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"Tools/CmdLine/IccDumpProfile/iccDumpProfile.cpp","function":"DumpTagCore"}},{"digest":{"function_hash":"114279148802257884843798617549735130655","length":88},"id":"CVE-2026-50278-618f1268","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccTagBasic.h","function":"operator="},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccCmm.cpp","function":"CIccXform3DLut::ExtractInputCurves"},"deprecated":false,"digest":{"function_hash":"114771030459022235554755269981928754366","length":749},"id":"CVE-2026-50278-66281323"},{"source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccConnect/IccLibConnect/IccCmmConfig.cpp"},"deprecated":false,"digest":{"line_hashes":["149396982853640447098835282016832523717","34100248156742067126078312523241933077","227558370849481622936102653482809771481","132426846808647582361501413113353778171"],"threshold":0.9},"id":"CVE-2026-50278-66475e8a","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccStructFactory.cpp","function":"CIccBasicStructFactory::CreateStruct"},"deprecated":false,"digest":{"function_hash":"234213713283744361556280508997566490451","length":556},"id":"CVE-2026-50278-67aa6b27"},{"id":"CVE-2026-50278-6909ad39","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccCmm.cpp","function":"CIccPcsStepLab2ToLab::concat"},"deprecated":false,"digest":{"function_hash":"324889740523544349944120782985426047082","length":168}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"function":"WriteTIFF","file":"Tools/CmdLine/IccProfileVisualize/MiniTIFF.cpp"},"deprecated":false,"digest":{"function_hash":"71631926963189631096800171905478135135","length":5691},"id":"CVE-2026-50278-6e2508db"},{"digest":{"line_hashes":["325609594791854627617650118570760412931","157447195305090798005628202799399984866","172912434487972838706836216195950011113","302337267559913073606010125151696369420","111225075536817810818368933823545035324","296585804188429649895511132971708983437","201296176608782836105231448334632456902","190751818258718093162042669002318428467","187976752352334229803264824673793493505","122976078729288550386411717855971182461","173860068731662765578404468213092158932","232829902233544477940100653227559553250","309251950297117958167161421155206886562","325609594791854627617650118570760412931","157447195305090798005628202799399984866","172912434487972838706836216195950011113","157005884992228088943755955561339295481","61318086639026007070036467921983022875","179111292274912026980802969805867284419","280094699421725471960617859938244329322","50622989005661031371318928996042637893","211659235830936848955213700963716518699","97071457207987547334793865727554284500","245070813484747815105258272886395896070","139099069616263649101486534864315914749","6408197732098189251764572267911511317","178463924830857546151489507292110134159"],"threshold":0.9},"id":"CVE-2026-50278-701803b5","signature_type":"Line","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccTagBasic.h"},"deprecated":false},{"id":"CVE-2026-50278-70900854","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccCmm.cpp","function":"CIccPcsStep::GetNewApply"},"deprecated":false,"digest":{"function_hash":"272895675932185694222638931935499693578","length":70}},{"digest":{"function_hash":"17896430641621155097987595611055357719","length":264},"id":"CVE-2026-50278-7842b8a5","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"function":"CIccBasicArrayFactory::CreateArray","file":"IccProfLib/IccArrayFactory.cpp"},"deprecated":false},{"digest":{"function_hash":"320921392043061089212392327650728322252","length":407},"id":"CVE-2026-50278-7cd17879","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccCmm.cpp","function":"CIccPcsStepLab2ToXYZ::concat"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"248295346065195174835660355252793354899","length":13847},"id":"CVE-2026-50278-7d6a0dbd","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"Tools/CmdLine/IccDumpProfile/iccDumpProfile.cpp","function":"main"}},{"target":{"file":"IccJSON/IccLibJSON/IccIoJson.cpp","function":"CIccJsonStandardFileIO::OpenFile"},"deprecated":false,"digest":{"function_hash":"304809448969382165710237416494124025164","length":208},"id":"CVE-2026-50278-7d947638","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccCmm.cpp","function":"CIccNamedColorCmm::GetNewApplyCmm"},"deprecated":false,"digest":{"function_hash":"43826400689345611840308716197437532403","length":397},"id":"CVE-2026-50278-827e1f2c"},{"deprecated":false,"digest":{"function_hash":"114279148802257884843798617549735130655","length":88},"id":"CVE-2026-50278-8a882d8e","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccTagBasic.h","function":"operator="}},{"deprecated":false,"digest":{"function_hash":"1887311641673831420784837492569203312","length":313},"id":"CVE-2026-50278-8c023de1","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccCmm.cpp","function":"CIccXform::Create"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccJSON/IccLibJSON/IccTagJsonFactory.cpp","function":"CIccTagJsonFactory::CreateTag"},"deprecated":false,"digest":{"length":3224,"function_hash":"133178019379321890454684156037792749942"},"id":"CVE-2026-50278-9150e41f"},{"deprecated":false,"digest":{"function_hash":"189393230821052854964908253596087299034","length":121},"id":"CVE-2026-50278-92a80144","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccCmm.cpp","function":"CIccPcsStepMpe::GetNewApply"}},{"signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccMpeFactory.cpp"},"deprecated":false,"digest":{"line_hashes":["107121047562132152598561971285464210859","288724821716736221852583436999583534285","122027060193043958331322882194853772630","118215398103025719051506170637158342990","93049571054232411003344386209245235010","66055450415682677945391212237056176713","166324923897413883938615512413788163595","207800680724119100378789347802615918356","267934662702605426049024332293771523765","190186158958609732400832363453243615072","321495594301915644341427427010755687673","146886338960801408159242886980366276113","19755105881728862958652469966952664780","91500387668465599935871026273502272557","883497373033948700426134618779492138","15810116736718478332155261953877158277","164191641097567575311169616205171990184","155546938300788775981101165177728746314","196089244698893451959411981671688779810","135011100674378925814953797206042270554","72670943097143203138801770446458886829","308038339458706005231077687385028828204","287560172569335479352381227882106040604","250905489879462229850924012188629458702","326056142482931162131900712911624124165","196974134384114624576081671976270783090","211259844725656673107361766845667840696","118936548158630982157646216021104963556","206703064330517905512281327183095461760","92094389318558047165337716762494737354","148295504571614552805434695972155442979","293720325084336182837214368163049744163","158068710265844098519896055594208791734","311448642416601120199743903874257110373","185916703704229339708870427000782543154","240384624992627909086065459694373781326","9436457493859087127774673023806924922","182578682326731246245418589085814747324"],"threshold":0.9},"id":"CVE-2026-50278-967bbd83","signature_type":"Line"},{"digest":{"function_hash":"121247180902569799992282772029155544732","length":231},"id":"CVE-2026-50278-96de4cc1","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccCmm.cpp","function":"CIccXformMonochrome::ExtractInputCurves"},"deprecated":false},{"digest":{"line_hashes":["252931032170793062186340297116883134639","130731592598133197494936657803830016812","185329232801781787215686649442977706601","307089064406609007795998984443058123877","312538248688070950456796130235870242634","267303857255740064274461854137377499187","146289150098461920592504072859501491913","159862480875555946729799902722031112463","277811669730277283806744715039165989238","112505097301890535934973731176678988365","299807771826961736342703737947290979599","237413948955280291487727667240427804494","257437120615406808188569356018302396965","269656659220127599745265261378753713260","72541456717020143789386411672805079687","110795098090670733380519287233713327077","77449999197191644967726084611877506013","33620942184322885476932957879270843052","251145474406484591734531191437126884226","188539892199019826999672564887847090050","223949245912907591750499046719881191847"],"threshold":0.9},"id":"CVE-2026-50278-9751fb6c","signature_type":"Line","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccJSON/IccLibJSON/IccMpeJsonFactory.cpp"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"110897394057884129530800048412095908513","length":887},"id":"CVE-2026-50278-a01a3877","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccCmm.cpp","function":"CIccXform4DLut::ExtractInputCurves"}},{"source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccCmm.cpp"},"deprecated":false,"digest":{"line_hashes":["184466473939354449397411740424799360786","101993261831679730655881497808827965749","71271509623512987881787140405597599843","69523977722727969467623403297859522150","190110469756254071250141152386537051128","295970543254615281071480544525371040983","7874304261383355917524808938671762020","259966118165281823250280842837063185842","197968756455768489785532938011386876343","51108511697132668974700338683123621064","233016320688039189440381339455989473193","97098178944952746598625291304376928612","176176702527775030533180885729721143905","36710149898846730312978723524251180995","324234564198229288192733270405289364608","57493801513341298784904918044429637324","311073218383966244249958480352141343791","100042859976382274066433518984239234982","235814858478214762355283138935249934119","146323831525129806613784993773528390035","241931813817519681923185727021953366659","306921804941344750740866463070211632387","306055366247536433288959268530094760306","122070408879299885908596813089047368220","74833361488881294385305866023780006235","169031051500395836477294996030213307602","300607516917517990480612404302209561040","221371112470482410477991634307256383422","146323831525129806613784993773528390035","59321612409105442944000598937707376833","254451105503124289397501700830994037212","244347209351460222815256299017884424736","146323831525129806613784993773528390035","197076863662663953790630415340742594593","131165465794315165618529089421240656326","183469829800929530304349681820083935668","44802481261176001557982233247678294439","90200847593917319529938496234493304000","132351561289805413837725976218969319119","213403356998992191660481983487350595418","56891009236776998845726694597334418103","146323831525129806613784993773528390035","59321612409105442944000598937707376833","254451105503124289397501700830994037212","309005693275337059348011946798216710810","186608301941739553775775241584339073212","330888710970513460064478396077967830304","254451105503124289397501700830994037212","325109193605834107926273311249930277879","222752303098634974948560579420477538639","323973373071121019322949080664896613460","254451105503124289397501700830994037212","39630982866629655879440893836149499442","67244014167216918157017310426340503339","232891256914363446223913698586105631869","254064036386201117888769542904456159733","7127366796234504891774234763950806812","275662030065026457928182095257428119345","245021164153527562393999556005283607135","208706341500941304753569959455172514766","285307333513327951423576426560550246417","307668020677329400889819542492719740869","283966560114063125846503835568525492040","320123118988281002957253865154586963225","245021164153527562393999556005283607135","208706341500941304753569959455172514766","285307333513327951423576426560550246417","307668020677329400889819542492719740869","289250539774521149685345927004234009042","117694837580528703891942421186372630275","207329792680683683309112439443071836464","26568806685439477407577535649211538625","102514973387236359519850811497486211536","175644334842420558211909358447684487900","335208295147504674304487372366433722938","307668020677329400889819542492719740869","324606587373274544208426400409808349463","71625726714955938244803282538974725100","207329792680683683309112439443071836464","26568806685439477407577535649211538625","102514973387236359519850811497486211536","175644334842420558211909358447684487900","335208295147504674304487372366433722938","307668020677329400889819542492719740869","84287490931132122759135104961540434311","829539762928515330189545345851369149","192948824836974031121706934849765698086","170401371744013827456702656330982485927","339261610382826783794150751657542649035","178742693637013877946827172370087726902","29173974644474563678687176144336261153","126558153029693546665949203558411650608","152252916910487900291274616839956632013","21582915756537689728060740663613132435","1949892564320450834336826170584505356","205646763319008212346616393327794538902","234829392920504948509204611927693214890","35039836503427255355894589664724052149","215149822866944940287963730835677666740","42437559317961653429251326565184211627","105098878042954135938536412788709268959","149250401607186129210709052864751937918","217145983884283316805301522194663470385","14583537147840489115715709914078261434","17143110211246376783053633803642082180","197238480482794689302418176386981380654","295210255074369360766444004523868242839","245845215506785569804323712728240958589","124854495257852943619323674431351940426","149250401607186129210709052864751937918","152252916910487900291274616839956632013","175090152218074345811810178729821314269","150731658051869249396310784107756777219","78601500196386981660913575564999475364","308062466581292123890877410796761635698","323088333260552428159134618380523175004","301908407561507027902906665255002295386","219926469703327692925083048603251496859","49990440392867145641196825721283388488","126558153029693546665949203558411650608","211777622801566925150722846049464223043","41360631773412855430863415602823523331","64881996912656601472370163883104906431","62188694561174852737024019637191826196","148182040238043742327665652491924291561","46881022949910092486168652813592132533","311780266932693727632507894795022484808","220747176862327740124161249791603627784","78995081800252458137165837537667629247","238481684941902662470555470379645311899","55000197872638700716679281144872907482","126558153029693546665949203558411650608","152252916910487900291274616839956632013","21582915756537689728060740663613132435","91106978802443646164685721867923370392","322046311806839790155589563072470602533","156697701762828460264536662755062619767","292245541918179985040681040795854499317","126645319132850027050162813204897360504","165401579624525439682116456510046544818","254962397921966983527836674427168835463","66471997382797606132704458645129653169","149250401607186129210709052864751937918","18019876138799776796659585665638524715","195943819114117558545208026242705711389","220884027888050459794073188008898298494","9964827982167752406826261161225962725","217145983884283316805301522194663470385","14583537147840489115715709914078261434","17143110211246376783053633803642082180","197238480482794689302418176386981380654","295210255074369360766444004523868242839","245845215506785569804323712728240958589","124854495257852943619323674431351940426","149250401607186129210709052864751937918","152252916910487900291274616839956632013","175090152218074345811810178729821314269","150731658051869249396310784107756777219","78601500196386981660913575564999475364","308062466581292123890877410796761635698","323088333260552428159134618380523175004","301908407561507027902906665255002295386","219926469703327692925083048603251496859","49990440392867145641196825721283388488","126558153029693546665949203558411650608","88740757357980683880748950946435000099","83253282974586157406762009670073067993","198624680033822178641650298997052298670","285221580478641946740502201747356357174","291443107450313786228768128720054540759","219926469703327692925083048603251496859","49990440392867145641196825721283388488","126558153029693546665949203558411650608","152252916910487900291274616839956632013","21582915756537689728060740663613132435","88304061249663183678981559926627995148","304469788592894629679156100101236464457","125861658531563030332076417829398943646","302357274095018212890879058396989007724","293539025090448385386480173539540799902","245845215506785569804323712728240958589","124854495257852943619323674431351940426","149250401607186129210709052864751937918","217145983884283316805301522194663470385","14583537147840489115715709914078261434","17143110211246376783053633803642082180","197238480482794689302418176386981380654","295210255074369360766444004523868242839","245845215506785569804323712728240958589","124854495257852943619323674431351940426","149250401607186129210709052864751937918","152252916910487900291274616839956632013","175090152218074345811810178729821314269","150731658051869249396310784107756777219","78601500196386981660913575564999475364","308062466581292123890877410796761635698","323088333260552428159134618380523175004","301908407561507027902906665255002295386","219926469703327692925083048603251496859","49990440392867145641196825721283388488","126558153029693546665949203558411650608","197132227268596669400425071696567731614","154302579107616787620155082693597181146","222109968308126923056572509626451450240","23624785793824422882689157142764242818","165919548130156238303777412537702672698","90854001822793857077159690342059802138","26675632438007025914504780723724707202","3726178521910408529826220620314824691","175534525596258419468095916295130308871","89218433349753285533074018274860410677","119530079928652939780787077191632122308","194170812829724196216239602341760973795","50314557475823177446795824662181216355","7720277873158572241821170427842417974","104140018851143381748798889337265239581","276492814892929551305463034684154278174","292525013345007032660823076884408342321","61056514649969302310795501102150457439","301798329765213329596519785154612510785","90670387971508542407432166963222216893","15301977114386010222144255557959589084","197132227268596669400425071696567731614","154302579107616787620155082693597181146","222109968308126923056572509626451450240","23624785793824422882689157142764242818","165919548130156238303777412537702672698","136542720842980002362023210330623371884","26430247065439345446697316832546239705","93467905027437414993126708149117016309","280795255303061108867478694454705885402","162894081600493810995860185762384726516","159957118335985117254399243483682989626","302813720531649358013037038318745742885","114905337016805439614048257586427816478","26861314855356276168124090916996867773","228625767473310862056945392896955310527","104195467975634782749143109493065492818","121379392387365150521331093903576110648","271262666455091069325907550989597603843","281745115408344076433082319879572739781","297752303408635194446015199970239165045","114905337016805439614048257586427816478","26861314855356276168124090916996867773","228625767473310862056945392896955310527","104195467975634782749143109493065492818","114905337016805439614048257586427816478","26861314855356276168124090916996867773","228625767473310862056945392896955310527","104195467975634782749143109493065492818","161357141711215087019072242801257906683","206468942703455003438307965973317956117","115636266319126471974808554406465541623","144504165032512866842184840748840585800","240057276818549200851098643062481188976","211196200975781956662297052995699586846","157544638422621605828456042087971665721","297444474989396670477747527252340407315","334113048177608346635310993591765669862","272123063178290486310898083270062130602","299721160538773531836854566922843232383","31380582460891346536490505903479204273","234883208623460641486855270661744531548","293509275149220569842615648742676456577","112372216148036742141457360045257298804"],"threshold":0.9},"id":"CVE-2026-50278-a49e4ef7","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-50278-a62374e6","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccCmm.cpp","function":"CIccPcsXform::pushXYZNormalize"},"deprecated":false,"digest":{"function_hash":"88537533562101084921484548485773611644","length":1119}},{"id":"CVE-2026-50278-aceb0187","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccJSON/IccLibJSON/IccMpeJsonFactory.cpp","function":"CIccMpeJsonFactory::CreateElement"},"deprecated":false,"digest":{"function_hash":"170442244263181056319898607480637472706","length":1033}},{"signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccTagBasic.h","function":"operator="},"deprecated":false,"digest":{"function_hash":"114279148802257884843798617549735130655","length":88},"id":"CVE-2026-50278-af844ff1","signature_type":"Function"},{"deprecated":false,"digest":{"length":359,"function_hash":"114261083742207339538136055315404031342"},"id":"CVE-2026-50278-b43dcd7a","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccCmm.cpp","function":"CIccXformMatrixTRC::ExtractOutputCurves"}},{"target":{"file":"IccProfLib/IccTagBasic.cpp","function":"operator="},"deprecated":false,"digest":{"function_hash":"38554394264403071820734173424414040792","length":89},"id":"CVE-2026-50278-b63d6075","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086"},{"id":"CVE-2026-50278-c16c5750","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"function":"CIccXformMatrixTRC::ExtractInputCurves","file":"IccProfLib/IccCmm.cpp"},"deprecated":false,"digest":{"function_hash":"281004080765760686995876415974084480442","length":356}},{"deprecated":false,"digest":{"function_hash":"258324728664805878233055135411492037421","length":73},"id":"CVE-2026-50278-c2bc7ff5","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccTagBasic.h","function":"operator="}},{"digest":{"line_hashes":["14607898291285859096017293389979924801","85913185025800086497414452452708434085","65860032269503335691776594569415316904","11231571625186771536145959416951124020"],"threshold":0.9},"id":"CVE-2026-50278-c75b8461","signature_type":"Line","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"Tools/CmdLine/IccProfileVisualize/MiniTIFF.cpp"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["260795835813956350945985032602722312233","117602539285389193722100866686204603290","120306284712401519976676941057171161525","280366181052002208686543834894762951681","313174494380348661815716207546647101786"],"threshold":0.9},"id":"CVE-2026-50278-c77fdbd5","signature_type":"Line","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"Tools/CmdLine/IccApplySearch/iccApplySearch.cpp"}},{"signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccMpeFactory.cpp","function":"CIccBasicMpeFactory::CreateElement"},"deprecated":false,"digest":{"length":1034,"function_hash":"259918380445358572905692588902492722906"},"id":"CVE-2026-50278-c828605f","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"86569558160568047993790753426195017424","length":241},"id":"CVE-2026-50278-ce8602e8","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccCmm.cpp","function":"CIccPcsStepXYZToLab::concat"}},{"target":{"file":"IccProfLib/IccStructFactory.cpp"},"deprecated":false,"digest":{"line_hashes":["57346557233078197695891118745132438923","218156594397105003033641118885702997240","41115458295631721915257355008599401929","228892047684047182418187110851128480627","188205358270162023488141907898038986928","124292577967321135057131083847861822819","102641724072788948823692100018849481965","137261207346517054037284122791369495649","322390372606838516697968339159691646841","154988696062902550796994709515023315297","101244278895021295391215865446599659081","303453249021308245882721365244226415495","206811610536757275166433515611225114677","13711540656592866616577737842570389953","219113793030409055788038833807093233816","194306992859642752591581930225222320129","74192710811251449794859360369761543319","248571081007490997936275271598474680237"],"threshold":0.9},"id":"CVE-2026-50278-d22ad81f","signature_type":"Line","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086"},{"signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccJSON/IccLibJSON/IccTagJsonFactory.cpp"},"deprecated":false,"digest":{"line_hashes":["210888936049067882919952673230266701266","197012901483905124084531811635424564884","227662565110389346628956366309256546220","91028029544744011023542046675426135372","79657361940915204761937722601858408969","262114282192106619939420088504201621375","286478717246588357133546163039506438472","178081222904904462763597052988912858975","33527620473896629443422802422485465181","144215316247608850848251749904518741904","109017810760483593807031561842474715115","171463824194151109071017262658220071976","32731894234176028223710257402166608770","55369448185117111143913762655260349815","5516477995420738044032371408966025190","202124677235526548293884627895267089673","20248408722787940772966870576176468296","10742782926481403840116954451337864247","324459684795788322847489168169373061102","110759132961802018714002932985973072474","241473444508804937336377915264435940109","207677580563563379281713982632619895694","183000281202674797384495339001153778217","253486533221803122777492755187838842965","47950623511664745456553694700817459731","125808899853759875317053677806799671679","76633925134841484505368003508446402339","92957857035560412779264226049802635897","58335563099402531597092079910465122311","104634579242664235463631793512888429457","306432535258712899763898977684173739732","217893532156790057644923727769053861484","104112973109922595271751287632916689150","49154334446671969411500041181518000577","34305631368458375325823125239015030795","223206027614738386251016248837531925674","18890034935831110826075325262949845784","47272595632272603476656841215197818997","264079014827753186908233747345736246142","34987094736924113329255040217559576400","112045068706850573787590391053147254058","282301466185123006708892402105389350738","224485772498831800720735703796093485626","29611040674540147089349524318265626782","109976030720886181996889008837249050667","68659136727277454674585629053365421345","46514825537851370100712138289334714339","246310207337489589749566816992961528592","1588956860885388316538318716589974926","55802803168954022621499072323410835701","5388199718608542048475672240785142455","241936207473389460798127378204294435304","184742462182632629410433482449515907132","118999932747075011043721146041545409137","261936628758806459468365632821291004962"],"threshold":0.9},"id":"CVE-2026-50278-dc572ecf","signature_type":"Line"},{"digest":{"function_hash":"65111184676756411196814116722345013743","length":8159},"id":"CVE-2026-50278-dd88890b","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"function":"main","file":"Tools/CmdLine/IccApplyNamedCmm/iccApplyNamedCmm.cpp"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"243933048191907306943814612950201913746","length":243},"id":"CVE-2026-50278-e3bf9582","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccCmm.cpp","function":"CIccPcsStepXYZToLab2::concat"}},{"digest":{"function_hash":"210969415224205195125356781018785445951","length":168},"id":"CVE-2026-50278-e95cdb86","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccCmm.cpp","function":"CIccPcsStepLabToLab2::concat"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["21352436087726550798077554021656195033","210757805757682140046385996991317499835","56120178368399185567304295567407041510","188657930622565855848614856588793935683","130492293202837655119812926994682134390","81276949484348066293929855397476858047"],"threshold":0.9},"id":"CVE-2026-50278-f88e64b7","signature_type":"Line","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccJSON/IccLibJSON/IccIoJson.cpp"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccCmm.cpp","function":"CIccXformMonochrome::ExtractOutputCurves"},"deprecated":false,"digest":{"function_hash":"54876843374148164300056412941917861627","length":234},"id":"CVE-2026-50278-f8df3375"},{"deprecated":false,"digest":{"function_hash":"293487440675243053530508629497408891534","length":406},"id":"CVE-2026-50278-f9c36a2a","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/002d1108c1bd674de0ac1b0abfa0162986f19086","target":{"file":"IccProfLib/IccCmm.cpp","function":"CIccPcsStepLabToXYZ::concat"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}