PT-2026-1405 · Iccdev · Iccdev

Xsscx · Published 2026-01-06 · Updated 2026-01-07 · CVE-2026-21485

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iccDEV versions prior to 2.3.1.2

Description iccDEV is a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and earlier contain Undefined Behavior (UB) and Out of Memory errors. Undefined Behavior refers to situations where the behavior of a program is not specified by the programming language standard, potentially leading to unpredictable results or crashes. Out of Memory errors occur when a program attempts to allocate more memory than is available, resulting in program termination.

Recommendations Update to version 2.3.1.2 or later.

Exploit

Fix

Resource Exhaustion

Out of bounds Read

Memory Corruption

RCE

NULL Pointer Dereference

Integer Overflow

Weakness Enumeration

CWE-400

CWE-125

CWE-787

CWE-20

CWE-476

CWE-1284

CWE-190

Related Identifiers

CVE-2026-21485

GHSA-CHP2-4GV5-2432

Affected Products

Iccdev

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21485.json · Exploit
• 🔥 https://github.com/InternationalColorConsortium/iccDEV/issues/340 · Exploit
• https://github.com/InternationalColorConsortium/iccDEV/commit/c136aac51d25cbb4d9db63f071edad4f088843df · Patch
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-chp2-4gv5-2432 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-21485 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21485 · Security Note
• https://twitter.com/CCBalert/status/2008823851052867897 · Twitter Post
• https://t.me/CVEtracker/41463 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2008520147837886613 · Twitter Post