CVE-2026-34556: iccDEV: HBO in icAnsiToUtf8()
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a heap-buffer-overflow (HBO) in icAnsiToUtf8() in the XML conversion path. The issue is triggered by a crafted ICC profile which causes icAnsiToUtf8(std::string&, char const) to treat an input buffer as a C-string and call operations that rely on strlen()/null-termination. AddressSanitizer reports an out-of-bounds READ of size 115 past a 114-byte heap allocation, with the failure observed while running the iccToXml tool. This issue has been patched in version 2.3.1.6.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34556?
CVE-2026-34556 is classified as a high severity vulnerability due to its potential to cause heap-buffer overflow.
How do I fix CVE-2026-34556?
To fix CVE-2026-34556, upgrade to iccDEV version 2.3.1.6 or later.
What does CVE-2026-34556 affect?
CVE-2026-34556 affects versions of iccDEV prior to 2.3.1.6 which utilize the icAnsiToUtf8() function.
What is the nature of the vulnerability in CVE-2026-34556?
The nature of CVE-2026-34556 is a heap-buffer-overflow triggered by a crafted ICC profile.
What can happen if CVE-2026-34556 is exploited?
If CVE-2026-34556 is exploited, it can lead to arbitrary code execution or crashes in applications using the affected library.