CVE-2026-21676 Details
Description
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have a Heap-based Buffer Overflow in its CIccMBB::Validate function which checks tag data validity. This issue is fixed in version 2.3.1.1.
A heap-based buffer overflow vulnerability has been identified in the iccDEV library, specifically in versions prior to 2.3.1.1. The issue arises in the CIccMBB::Validate function, which is responsible for checking the validity of tag data in ICC color management profiles. The vulnerability can be exploited by processing specially crafted ICC profiles that trigger the validation function's flawed logic, leading to a buffer overflow.
Users can upgrade to iccDEV version 2.3.1.2 or apply the patch available in pull request #231 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/InternationalColorConsortium/iccDEV/commit/e4c38a67d06073b38d58580b0cfc78ca61005f84 | [email protected] | Patch |
| https://github.com/InternationalColorConsortium/iccDEV/issues/215 | [email protected] | ExploitIssue TrackingVendor Advisory |
| https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-j5vv-p2hv-c392 | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| color iccdev | < 2.3.1.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 12, 2026 | Initial Analysis | [email protected] |
| Jan 6, 2026 | New CVE Received | [email protected] |