CVE-2026-24856: Color Iccdev vulnerability (CVSS 7.8)

Description

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Versions prior to 2.3.1.2 have an undefined behavior issue when floating-point NaN values are converted to unsigned short integer types during ICC profile XML parsing potentially corrupting memory structures and enabling arbitrary code execution. This vulnerability affects users of the iccDEV library who process ICC color profiles. ICC Profile Injection vulnerabilities arise when user-controllable input is incorporated into ICC profile data or other structured binary blobs in an unsafe manner. Version 2.3.1.2 contains a fix for the issue. No known workarounds are available.

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredNone

User interactionRequired

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Color Iccdev< 2.3.1.2

Remediation

Fixed in

Color Iccdev≥ 2.3.1.2

Patch & vendor advisories

References

https://github.com/InternationalColorConsortium/iccDEV/commit/5e53a5d25923b7794ba44e390e9b35d391f2b9c1Patch
https://github.com/InternationalColorConsortium/iccDEV/issues/532ExploitIssue TrackingVendor Advisory
https://github.com/InternationalColorConsortium/iccDEV/pull/541ExploitIssue TrackingPatch
https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-w585-cv3v-c396PatchVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-24856 being actively exploited?

CVE-2026-24856 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.25%.

How severe is CVE-2026-24856?

CVE-2026-24856 has a CVSS 3.1 base score of 7.8, rated high. EPSS estimates a 0.25% probability of exploitation.

Which products are affected by CVE-2026-24856?

Affected products include Color Iccdev.

How do I fix CVE-2026-24856?

Upgrade affected software to a fixed version, for example Color Iccdev 2.3.1.2 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-24856 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo