{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-24T03:35:57.262","vulnerabilities":[{"cve":{"id":"CVE-2026-34537","sourceIdentifier":"security-advisories@github.com","published":"2026-03-31T22:16:21.287","lastModified":"2026-04-20T13:51:55.080","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger Undefined Behavior (UB) in CIccOpDefEnvVar::Exec() due to invalid enum values being loaded for icSigCmmEnvVar. The issue is observable under UBSan as a “load of value … not a valid value for type icSigCmmEnvVar”, indicating an invalid enum/type value being consumed during ICC profile processing. This issue has been patched in version 2.3.1.6."},{"lang":"es","value":"iccDEV proporciona un conjunto de bibliotecas y herramientas para trabajar con perfiles de gestión de color ICC. Antes de la versión 2.3.1.6, un perfil ICC manipulado puede desencadenar Comportamiento Indefinido (CI) en CIccOpDefEnvVar::Exec() debido a que se cargan valores enum no válidos para icSigCmmEnvVar. El problema es observable bajo UBSan como una 'carga de valor... no es un valor válido para el tipo icSigCmmEnvVar', lo que indica que se consume un valor enum/tipo no válido durante el procesamiento del perfil ICC. Este problema ha sido parcheado en la versión 2.3.1.6."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-758"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*","versionEndExcluding":"2.3.1.6","matchCriteriaId":"DE133F29-9592-4669-8B76-9F7C88EFE17D"}]}]}],"references":[{"url":"https://github.com/InternationalColorConsortium/iccDEV/issues/670","source":"security-advisories@github.com","tags":["Issue Tracking","Exploit"]},{"url":"https://github.com/InternationalColorConsortium/iccDEV/pull/685","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-3m63-c4jf-592f","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}}]}