Log in Start free

Vulnerability · Published Feb 25, 2026 · Assigned by GitHub_M

CVE-2026-27691iccDEV has SIO in parse3DTable() at iccFromCube.cpp Line 218

Medium 6.2

In plain English

A medium-severity integer overflow in iccDEV from InternationalColorConsortium. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)6.2Medium
Exploit odds (30 days)0.2%top 91.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, signed integer overflow in iccFromCube.cpp during multiplication triggers undefined behavior, potentially causing crashes or incorrect ICC profile generation when processing crafted/large cube inputs. Commit 43ae18dd69fc70190d3632a18a3af2f3da1e052a fixes the issue. No known workarounds are available.

Affected products (as reported)

VendorProductVersions
InternationalColorConsortium iccDEV <= 2.3.1.4

Weakness: CWE-190, CWE-681 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References