IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-02-25 15:20

MODIFIED

2026-02-25 15:22

CVSS_SCORE V3

6.2

EPSS (Prob. Exploit)

0.20%

Top 90.4%

DATA SOURCES:

NVD 🔗 2026-02-25 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 OSV 🔗 2026-03-04

> DESCRIPTION

iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, signed integer overflow in iccFromCube.cpp during multiplication triggers undefined behavior, potentially causing crashes or incorrect ICC profile generation when processing crafted/large cube inputs. Commit 43ae18dd69fc70190d3632a18a3af2f3da1e052a fixes the issue. No known workarounds are available.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> CVSS V3 METRICS

CVSS_VECTOR

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EXPLOITABILITY

2.5

IMPACT

3.6

> MÉTRIQUES CVSS DÉTAILLÉES

                CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
            

Métrique	Valeur	Interprétation
AV (Vecteur d'Attaque) Attack Vector	Local (L)	Exploit nécessite un accès local au système
AC (Complexité d'Attaque) Attack Complexity	Low (L)	Peu de conditions requises pour exploiter
PR (Privilèges Requis) Privileges Required	None (N)	Aucune authentification requise
UI (Interaction Utilisateur) User Interaction	None (N)	Aucune interaction utilisateur nécessaire
S (Périmètre) Scope	Unchanged (U)	Impact reste dans le périmètre du composant compromis
C (Impact Confidentialité) Confidentiality Impact	None (N)	Aucune divulgation d'informations
I (Impact Intégrité) Integrity Impact	None (N)	Aucune modification de données possible
A (Impact Disponibilité) Availability Impact	High (H)	Interruption totale du service possible

> RÉSUMÉ DES IMPACTS

Confidentialité

None

Aucune divulgation d'informations

Intégrité

None

Aucune modification de données possible

Disponibilité

High

Interruption totale du service possible

> WEAKNESSES

CWE-190 CWE-681

> CWE DETAILED DESCRIPTIONS

CWE-190: Integer Overflow or Wraparound - The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number. | CWE-681: Incorrect Conversion between Numeric Types - When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

iccDEV has SIO in parse3DTable() at iccFromCube.cpp Line 218

AFFECTED PACKAGES:

Unknown / Unknown

ALIASES:

GHSA-4gfj-4cjh-53v5

> HISTORIQUE DES MODIFICATIONS

Première apparition

25/02/2026 15:20

Source: NVD

📊 ENRICHISSEMENT 01/03/2026 06:46

CWE

Champ modifié: Description CWE

Ancienne valeur:

N/A

Nouvelle valeur:

CWE-190: Integer Overflow or Wraparound - The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will a...

Total des modifications: 1 Dernière mise à jour: 8 months ago

> REFERENCES

https://github.com/InternationalColorConsortium/iccDEV/commit/43ae18dd69fc70190d...

https://github.com/InternationalColorConsortium/iccDEV/issues/607

https://github.com/InternationalColorConsortium/iccDEV/pull/611

https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-...