CVE-2026-30978-nvd.nist.gov-Received

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a heap-use-after-free in CIccCmm::AddXfo…

Published:

9 March 2026 at 23:00:00

Alert date:

10 March 2026 at 19:06:17

Source:

nvd.nist.gov

Supply Chain & Dependencies

A heap-use-after-free vulnerability exists in iccDEV, a set of libraries and tools for working with ICC color management profiles. The vulnerability occurs in the CIccCmm::AddXform() function and causes invalid virtual pointer dereference leading to application crashes. This affects versions prior to 2.3.1.5 and has been fixed in version 2.3.1.5. The vulnerability could potentially be exploited to cause denial of service conditions in applications using the affected iccDEV library.

Technical details

Mitigation steps:

Affected products:

iccDEV