iccDEV Type Confusion Vulnerability in XML Curve Serialization

A type confusion vulnerability has been identified in the iccDEV library, specifically in versions through 2.3.1.1. The issue arises in the 'CIccSingleSampledeCurveXml' class during the serialization of XML curves. This vulnerability allows for improper handling of data types, which could potentially be exploited under certain conditions.

Impact

Exploitation of this vulnerability leads to undefined behavior, with the potential for memory corruption.

Reproduction

The vulnerability can be reproduced by using the 'CIccSingleSampledeCurveXml' class to parse an ICC file that includes a 'SingleSampledCurve' element. This can be done by calling the 'ParseXml' method with the appropriate XML node and parsing string. The type confusion will trigger a runtime error, as the downcasted object does not match the expected type.

Remediation

Users can upgrade to version 2.3.1.2 or later to address this vulnerability.