CVE-2026-24409

CVE-2026-24409 is a critical vulnerability affecting iccDEV versions 2.3.1.1 and below, stemming from Undefined Behavior and Null Pointer Dereference in CIccTagXmlFloatNum::ParseXml(). This flaw allows attackers to trigger denial-of-service, manipulate data, bypass application logic, or achieve code execution by crafting malicious ICC color profiles or structured binary blobs. With a CVSS score of 8.8 (HIGH), it presents a significant risk due to its network-based attack vector and low attack complexity, requiring user interaction. While there is no evidence of active exploitation, nor publicly available exploit code in Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered substantial community discussion, indicating awareness. Organizations using affected iccDEV versions should upgrade to 2.3.1.2 immediately to mitigate this risk.