Category: iccDEV

• Color Profile Injection (CPI)

  

  tl;dr: Color Profile Injection is due to untrusted inputs within color profile blobs. Updated 13-AUG-2026: From the WASM Draft Security Model just Published: When the ICC Tools are compiled to WASM then integrated into a browser, attacker-controlled profile metadata or generated outputs may be rendered in the DOM. If the application inserts this data into…

  h02332

  August 13, 2026

  C++, Color Profile Injection, iccDEV

  Logic Error, Program Flow

• CVE-2024-38427 – Profile Bleed

  

  A logic flaw existed in the CIccTagXmlProfileSequenceId::ParseXml function of the DemoIccMAX Project where the function unconditionally returned false and has been assigned CVE-2024-38427.

  h02332

  May 14, 2025

  C++, iccDEV, Quality Assurance

  Best Practice, Logic Error, Program Flow