CVE-2026-34549: iccDEV: UB at IccUtil.cpp
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is an Undefined Behavior (UB) condition in IccUtil.cpp triggered by a crafted input profile. Under UndefinedBehaviorSanitizer, the issue is reported as invalid left shift operations on icUInt32Number (unsigned 32-bit) where the shifted value “cannot be represented” in that type. This issue has been patched in version 2.3.1.6.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34549?
CVE-2026-34549 is classified as a high-severity vulnerability due to its potential to cause undefined behavior in applications.
How do I fix CVE-2026-34549?
To fix CVE-2026-34549, users should upgrade to version 2.3.1.6 or later of the iccDEV software.
What software is affected by CVE-2026-34549?
CVE-2026-34549 affects all versions of iccDEV prior to 2.3.1.6.
What is the nature of the issue described in CVE-2026-34549?
CVE-2026-34549 describes an Undefined Behavior (UB) condition triggered by crafted input profiles in IccUtil.cpp.
When was CVE-2026-34549 made public?
CVE-2026-34549 was publicly disclosed on October 17, 2026.