CVE-2026-22861
Published: 13 January 2026
Summary
CVE-2026-22861 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Color Iccdev. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 43.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-22861 is a heap-based buffer overflow vulnerability (associated with CWEs-120, CWE-130, CWE-252, and CWE-787) in the iccDEV library, specifically within the SIccCalcOp::Describe() function at IccProfLib/IccMpeCalc.cpp. The iccDEV library offers tools and libraries for interacting with, manipulating, and applying International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 are affected, impacting any applications or users that process ICC color profiles using this library.
With a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the vulnerability can be exploited by an unauthenticated remote attacker requiring low attack complexity and user interaction. The attacker tricks a user into processing a maliciously crafted ICC profile, potentially leading to high-impact consequences including unauthorized disclosure of information, modification of data, denial of service, and likely arbitrary code execution due to the buffer overflow.
The issue is addressed in iccDEV version 2.3.1.2. Security practitioners should update to this version for mitigation. Key resources include the fixing commit (https://github.com/InternationalColorConsortium/iccDEV/commit/fa9a364c01fc2e59eb2291e1f9b1c1359b7d5329), related pull requests #475 (https://github.com/InternationalColorConsortium/iccDEV/pull/475) and #476 (https://github.com/InternationalColorConsortium/iccDEV/pull/476), and the GitHub security advisory (https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-vr49-3vf8-7j5h).
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2412
Vulnerability details
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Prior to 2.3.1.2, There is a heap-based buffer overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cpp. This vulnerability affects…
more
users of the iccDEV library who process ICC color profiles. The vulnerability is fixed in 2.3.1.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in ICC profile processing library enables client-side code execution via malicious file opened by user (T1203, T1204.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely flaw remediation by updating the iccDEV library to version 2.3.1.2 or later to eliminate the heap-based buffer overflow vulnerability.
Implements memory protection mechanisms such as heap randomization and guard pages to directly mitigate exploitation of the heap buffer overflow in SIccCalcOp::Describe().
Requires validation of ICC color profile inputs to reject malformed profiles that could trigger the buffer overflow during processing.