CVE-2026-34548: iccDEV: UB at IccUtilXml.cpp
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is an Undefined Behavior (UB) condition in the XML conversion tooling path (iccToXml) caused by an implicit conversion from a negative signed integer to icUInt32Number (unsigned 32-bit), which changes the value. This issue has been patched in version 2.3.1.6.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34548?
CVE-2026-34548 is categorized as a medium severity vulnerability due to its potential to cause undefined behavior in the application.
How do I fix CVE-2026-34548?
To fix CVE-2026-34548, update your iccDEV library to version 2.3.1.6 or later.
What is the impact of CVE-2026-34548?
The impact of CVE-2026-34548 includes the possibility of undefined behavior when using the iccToXml function in the affected versions.
Which versions are affected by CVE-2026-34548?
CVE-2026-34548 affects iccDEV versions prior to 2.3.1.6.
Is CVE-2026-34548 exploitable remotely?
CVE-2026-34548 does not have evidence indicating it is remotely exploitable, as it depends on local processing of ICC profiles.