PT-2026-1504 · Iccdev · Iccdev

Xsscx · Published 2026-01-06 · Updated 2026-01-07 · CVE-2026-21491

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions iccDEV versions prior to 2.3.1.2

Description iccDEV is a set of libraries and tools for interacting with International Color Consortium (ICC) color management profiles. A flaw exists in versions before 2.3.1.2 that can lead to a unicode buffer overflow within the CIccTagTextDescription function when processing ICC color profiles.

Recommendations Update to version 2.3.1.2 or later.

Exploit

Fix

Heap Based Buffer Overflow

Out of bounds Read

Weakness Enumeration

CWE-193

CWE-122

CWE-125

Related Identifiers

CVE-2026-21491

GHSA-4PV4-4X2X-6J88

Affected Products

Iccdev

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21491.json · Exploit
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-4pv4-4x2x-6j88 · Vendor Advisory
• https://github.com/InternationalColorConsortium/iccDEV/commit/7c2cb719a9de1c00844e457e070d657314383ee3 · Patch
• https://github.com/InternationalColorConsortium/iccDEV/commit/e91fe722ac54ce497d410153e7405090e0565d7b · Patch
• https://github.com/InternationalColorConsortium/iccDEV/issues/396 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21491 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21491 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2008727472355873110 · Twitter Post
• https://t.me/CVEtracker/41524 · Telegram Post
• https://twitter.com/CVEnew/status/2008622613808251135 · Twitter Post