CVE-2026-50278

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions prior to 2.3.2.1 have a `CIccEmbedIO::Read8()` size_t underflow. The issue arises due to an embedded-profile read defect when parsing ICC profiles containing `icSigEmbeddedV5ProfileTag` data with `icSigEmbeddedProfileType` payloads. Version 2.3.2.1 patches the issue. No known workarounds are available.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/InternationalColorConsortium/iccDEV/commit/002d1108c1bd674de0ac1b0abfa0162986f19086
https://github.com/InternationalColorConsortium/iccDEV/issues/987
https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-7qjg-7qq4-c77j

Configurations

No configuration.

History

15 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) iccDEV proporciona un conjunto de bibliotecas y herramientas para trabajar con perfiles de gestión de color ICC. Las versiones anteriores a la 2.3.2.1 tienen un desbordamiento negativo de size_t en 'CIccEmbedIO::Read8()'. El problema surge debido a un defecto de lectura de perfil incrustado al analizar perfiles ICC que contienen datos 'icSigEmbeddedV5ProfileTag' con cargas útiles 'icSigEmbeddedProfileType'. La versión 2.3.2.1 corrige el problema. No se conocen soluciones alternativas disponibles.

Information

Published : 2026-08-21 15:16

Updated : 2026-10-15 19:10

NVD link : CVE-2026-50278

Mitre link : CVE-2026-50278

CVE.ORG link : CVE-2026-50278

JSON object : View

Products Affected

No product.

CWE

CWE-125

Out-of-bounds Read

CWE-190

Integer Overflow or Wraparound

CWE-704

Incorrect Type Conversion or Cast

{"id": "CVE-2026-50278", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50278", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-26T17:28:51.349857Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "InternationalColorConsortium", "product": "iccDEV", "versions": [{"status": "affected", "version": "< 2.3.2.1"}]}]}], "published": "2026-08-21T15:16:41.603", "references": [{"url": "https://github.com/InternationalColorConsortium/iccDEV/commit/002d1108c1bd674de0ac1b0abfa0162986f19086", "source": "security-advisories@github.com"}, {"url": "https://github.com/InternationalColorConsortium/iccDEV/issues/987", "source": "security-advisories@github.com"}, {"url": "https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-7qjg-7qq4-c77j", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-190"}, {"lang": "en", "value": "CWE-704"}]}], "descriptions": [{"lang": "en", "value": "iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions prior to 2.3.2.1 have a `CIccEmbedIO::Read8()` size_t underflow. The issue arises due to an embedded-profile read defect when parsing ICC profiles containing `icSigEmbeddedV5ProfileTag` data with `icSigEmbeddedProfileType` payloads. Version 2.3.2.1 patches the issue. No known workarounds are available."}, {"lang": "es", "value": "iccDEV proporciona un conjunto de bibliotecas y herramientas para trabajar con perfiles de gesti\u00f3n de color ICC. Las versiones anteriores a la 2.3.2.1 tienen un desbordamiento negativo de size_t en 'CIccEmbedIO::Read8()'. El problema surge debido a un defecto de lectura de perfil incrustado al analizar perfiles ICC que contienen datos 'icSigEmbeddedV5ProfileTag' con cargas \u00fatiles 'icSigEmbeddedProfileType'. La versi\u00f3n 2.3.2.1 corrige el problema. No se conocen soluciones alternativas disponibles."}], "lastModified": "2026-10-15T19:10:00.173", "sourceIdentifier": "security-advisories@github.com"}