PT-2026-1503 · Iccdev · Iccdev

Xsscx · CVE-2026-21490 · Publicado 2026-01-06 · Atualizado 2026-01-07

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions iccDEV versions prior to 2.3.1.2

Description iccDEV is a set of libraries and tools for interacting with International Color Consortium (ICC) color management profiles. A flaw exists in versions prior to 2.3.1.2 that can lead to a heap buffer overflow within the CIccTagLut16::Validate() function when processing ICC color profiles. No workarounds are available.

Recommendations Update to version 2.3.1.2 or later.

Exploit

Correção

Out of bounds Read

Heap Based Buffer Overflow

Enumeração de Fraquezas

CWE-125

CWE-193

CWE-122

Identificadores relacionados

CVE-2026-21490

GHSA-9Q9C-699Q-XR2Q

Produtos afetados

Iccdev

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21490.json · Exploit
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-9q9c-699q-xr2q · Aviso do Fabricante
• https://github.com/InternationalColorConsortium/iccDEV/commit/e91fe722ac54ce497d410153e7405090e0565d7b · Correção
• https://github.com/InternationalColorConsortium/iccDEV/issues/397 · Aviso do Fabricante
• https://github.com/InternationalColorConsortium/iccDEV/commit/7c2cb719a9de1c00844e457e070d657314383ee3 · Correção
• https://twitter.com/CVEnew/status/2008622614684856431 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2008730032277991809 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-21490 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-21490 · Nota de Segurança
• https://t.me/CVEtracker/41523 · Publicação no Telegram