CVE-2026-27692

iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, heap-buffer-overflow read occurs during CIccTagTextDescription::Release() when strlen() reads past a heap buffer while parsing ICC profile XML text description tags, causing a crash. Commit 29d088840b962a7cdd35993dfabc2cb35a049847 fixes the issue. No known workarounds are available.

• CWE-125
• CWE-170
• CWE-787
• CWE-787

• https://github.com/InternationalColorConsortium/iccDEV/commit/29d088840b962a7cdd35993dfabc2cb35a049847Patch
• https://github.com/InternationalColorConsortium/iccDEV/issues/609Exploit, Issue Tracking
• https://github.com/InternationalColorConsortium/iccDEV/pull/610Issue Tracking, Patch
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-3869-prw8-gjqrVendor Advisory

Published

Feb 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27687Due to missing authorization check in SAP S/4HANA HCM Portug…5.8
• CVE-2026-27688Due to a missing authorization check in SAP NetWeaver Applic…5
• CVE-2026-27689Due to an uncontrolled resource consumption (Denial of Servi…7.7
• CVE-2026-2769Use-after-free in the Storage: IndexedDB component. This vul…8.8
• CVE-2026-27690Due to an HTTP Request Smuggling vulnerability in SAP Approu…9.1
• CVE-2026-27691iccDEV provides a set of libraries and tools for working wit…5.5
• CVE-2026-27693Traccar is an open source GPS tracking system. In org.tracca…5.4
• CVE-2026-27694Traccar is an open source GPS tracking system. In org.tracca…5.4
• CVE-2026-27695zae-limiter is a rate limiting library using the token bucke…5.3
• CVE-2026-27696changedetection.io is a free open source web page change det…8.6
• CVE-2026-27697baserCMS is a website development framework. Prior to versio…9.8
• CVE-2026-27699The `basic-ftp` FTP client library for Node.js contains a pa…9.8