CVE-2026-34550: iccDEV: UB at IccIO.cpp
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is an Undefined Behavior (UB) condition in IccProfLib/IccIO.cpp caused by an implicit conversion from a negative signed integer to sizet (unsigned), which changes the value. This issue has been patched in version 2.3.1.6.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34550?
CVE-2026-34550 has been classified as a moderate severity vulnerability due to the potential for undefined behavior leading to application crashes or data corruption.
How do I fix CVE-2026-34550?
To fix CVE-2026-34550, upgrade to iccDEV version 2.3.1.6 or later, which addresses the undefined behavior issue.
What causes CVE-2026-34550?
CVE-2026-34550 is caused by an implicit conversion from a negative signed integer to an unsigned size_t type in the IccIO.cpp file.
Which software versions are affected by CVE-2026-34550?
Versions of iccDEV prior to 2.3.1.6 are affected by CVE-2026-34550.
What is the impact of CVE-2026-34550 on users?
The impact of CVE-2026-34550 can include application instability, data loss, or crashes when handling ICC color management profiles.