CVE-2026-24404
Published: 24 January 2026
Summary
CVE-2026-24404 is a high-severity Improper Input Validation (CWE-20) vulnerability in Color Iccdev. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 34.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-11 (Error Handling).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and correction of flaws such as the null pointer dereference in iccDEV, directly addressing the vulnerability via patching to version 2.3.1.2.
Mandates validation of all user inputs including malicious ICC profile data to prevent unsafe incorporation leading to null pointer dereferences and undefined behavior.
Ensures errors from invalid inputs or null pointers are handled without compromising system security, mitigating DoS crashes, data manipulation, and potential code execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables client-side exploitation via malicious ICC profiles for code execution (T1203) and application crashes/DoS (T1499.004), requiring user interaction.
NVD Description
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In versions 2.3.1.1 and below, CIccXmlArrayType() contains a Null Pointer Dereference and Undefined Behavior vulnerability. This occurs when user-controllable input is unsafely incorporated into ICC…
more
profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
Deeper analysisAI
CVE-2026-24404 is a Null Pointer Dereference and Undefined Behavior vulnerability in the CIccXmlArrayType() function within iccDEV, a set of libraries and tools for interacting with, manipulating, and applying ICC color management profiles. The flaw affects versions 2.3.1.1 and below, where user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs, leading to improper handling. Associated CWEs include CWE-20 (Improper Input Validation), CWE-476 (NULL Pointer Dereference), CWE-690 (Unchecked Return Value to NULL Pointer Dereference), and CWE-758 ( Reliance on Undefined, Unspecified, or Implementation-Defined Behavior). The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H), indicating high availability impact with low integrity impact.
Remote attackers without privileges can exploit this vulnerability by tricking users into processing maliciously crafted ICC profiles or binary blobs via applications that rely on iccDEV for color management. Exploitation requires user interaction, such as opening a file, but can result in denial of service through crashes, data manipulation, bypassing application logic, or even code execution under certain conditions.
The issue has been addressed in iccDEV version 2.3.1.2. Official mitigation details are available in the project's GitHub security advisory (GHSA-hqfg-45jp-hp9f), related issue tracker (#488), and the fixing commit (cd637eb33f0c8055fa54d8776e00555d3d39ef0c), which practitioners should review for patch deployment and upgrade guidance in affected environments.
Details
- CWE(s)