PT-2026-2068 · Iccdev · Iccdev

Xsscx · CVE-2026-21502 · Publicado 2026-01-07 · Atualizado 2026-01-08

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions iccDEV versions prior to 2.3.1.2

Description iccDEV is a set of libraries and tools used for interacting with, manipulating, and applying ICC color management profiles. A NULL pointer dereference issue exists in the XML tag parser in versions prior to 2.3.1.2. This issue can be triggered via the XML tag parser.

Recommendations Update to iccDEV version 2.3.1.2 or later.

Exploit

Correção

NULL Pointer Dereference

Unchecked Return Value

RCE

Enumeração de Fraquezas

CWE-476

CWE-252

CWE-20

CWE-690

Identificadores relacionados

CVE-2026-21502

GHSA-67R8-Q3MH-42J6

Produtos afetados

Iccdev

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21502.json · Exploit
• 🔥 https://github.com/InternationalColorConsortium/iccDEV/issues/368 · Exploit
• https://github.com/InternationalColorConsortium/iccDEV/commit/d04c236775e89a029f93efcc242fdb1fbc245a1c · Correção
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-67r8-q3mh-42j6 · Nota
• https://github.com/InternationalColorConsortium/iccDEV/pull/407 · Nota
• https://github.com/InternationalColorConsortium/iccDEV/commit/d9e42a1fb2606e25e498eb94f34f6da89f522e35 · Correção
• https://twitter.com/VulmonFeeds/status/2009088521584234644 · Publicação no Twitter
• https://t.me/CVEtracker/41624 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-21502 · Nota de Segurança
• https://twitter.com/CVEnew/status/2008959514725474473 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-21502 · Aviso do Fabricante