CVE-2026-22047
Published: 07 January 2026
Summary
CVE-2026-22047 is a high-severity Improper Input Validation (CWE-20) vulnerability in Color Iccdev. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 39.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Mandates timely remediation of identified software flaws, directly requiring patching of the heap-buffer-overflow in iccDEV versions prior to 2.3.1.2.
Implements memory protection mechanisms to prevent unauthorized code execution from heap buffer overflow exploits in the iccDEV library.
Requires validation of untrusted inputs like ICC color profiles to address improper input handling leading to the buffer overflow.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap-buffer-overflow in iccDEV library enables arbitrary code execution via exploitation of client software processing untrusted ICC profiles, directly mapping to Exploitation for Client Execution.
NVD Description
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a heap-buffer-overflow vulnerability in `SIccCalcOp::Describe()` at `IccProfLib/IccMpeCalc.cpp`. This vulnerability affects users…
more
of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
Deeper analysisAI
CVE-2026-22047 is a heap-buffer-overflow vulnerability in the iccDEV library, which provides tools and libraries for interacting with, manipulating, and applying International Color Consortium (ICC) color management profiles. The flaw resides in the `SIccCalcOp::Describe()` function within `IccProfLib/IccMpeCalc.cpp` and affects all versions prior to 2.3.1.2. Applications or systems that process untrusted ICC color profiles using the vulnerable iccDEV library are at risk.
Attackers can exploit this vulnerability remotely over the network with low complexity and no required privileges, though user interaction is necessary, such as convincing a user to open or process a malicious ICC profile. Successful exploitation leads to high-impact confidentiality, integrity, and availability consequences (CVSS 8.8), potentially enabling arbitrary code execution, data corruption, or denial of service via heap overflow. The issue maps to CWEs including CWE-787 (Out-of-bounds Write), CWE-252 (Unchecked Return Value), CWE-130 (Improper Handling of Length Parameter Inconsistency), and CWE-20 (Improper Input Validation).
The official patch is available in iccDEV version 2.3.1.2, as detailed in the project's GitHub security advisory (GHSA-22q7-8347-79m5), pull request #459, and issue #454. No workarounds are known, so security practitioners should prioritize upgrading affected libraries and scanning for vulnerable versions in dependent software.
Details
- CWE(s)