CVE-2026-22046

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a heap-buffer-overflow vulnerability in `CIccProfileXml::ParseBasic()` at `IccXML/IccLibXML/IccProfileXml.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

• CWE-20
• CWE-130
• CWE-252
• CWE-843
• CWE-787

• https://github.com/InternationalColorConsortium/iccDEV/issues/448Issue Tracking
• https://github.com/InternationalColorConsortium/iccDEV/pull/451Patch
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-7v4q-mhr2-hj7rPatch, Vendor Advisory
• https://github.com/InternationalColorConsortium/iccDEV/issues/448Issue Tracking
• https://github.com/InternationalColorConsortium/iccDEV/pull/451Patch

Published

Jan 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22040NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging …5.3
• CVE-2026-22041Logging Redactor is a Python library designed to redact sens…5.3
• CVE-2026-22042RustFS is a distributed object storage system built in Rust.…8.8
• CVE-2026-22043RustFS is a distributed object storage system built in Rust.…9.8
• CVE-2026-22044GLPI is a free asset and IT management software package. Fro…8.8
• CVE-2026-22045Traefik is an HTTP reverse proxy and load balancer. Prior to…7.5
• CVE-2026-22047iccDEV provides a set of libraries and tools that allow for …8.8
• CVE-2026-22048StorageGRID (formerly StorageGRID Webscale) versions prior t…7.1
• CVE-2026-22049ONTAP versions 9.16.1 and higher with WebAuthn multi-factor …8.7
• CVE-2026-2205A vulnerability was identified in WeKan up to 8.20. This aff…5.3
• CVE-2026-22050ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to …4.3
• CVE-2026-22051StorageGRID (formerly StorageGRID Webscale) versions prior t…4.3