PT-2026-2064 · Iccdev · Iccdev

Xsscx · Published 2026-01-07 · Updated 2026-01-07 · CVE-2026-21498

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions iccDEV versions prior to 2.3.1.2

Description iccDEV is a set of libraries and tools for interacting with ICC color management profiles. A NULL pointer dereference issue exists in the XML calculator parser in versions prior to 2.3.1.2.

Recommendations Update to iccDEV version 2.3.1.2 or later.

Exploit

Fix

NULL Pointer Dereference

Unchecked Return Value

RCE

Weakness Enumeration

CWE-476

CWE-252

CWE-20

CWE-690

Related Identifiers

CVE-2026-21498

GHSA-6822-QVXQ-M736

Affected Products

Iccdev

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21498.json · Exploit
• 🔥 https://github.com/InternationalColorConsortium/iccDEV/issues/375 · Exploit
• https://github.com/InternationalColorConsortium/iccDEV/commit/75f124f40ba45491211cb4b67f0e05b7c7d59553 · Patch
• https://github.com/InternationalColorConsortium/iccDEV/commit/bdfa31940726aaabb0a6f19194d9062ba0598959 · Patch
• https://osv.dev/vulnerability/CVE-2026-21498 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21498 · Security Note
• https://github.com/InternationalColorConsortium/iccDEV/pull/404 · Note
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-6822-qvxq-m736 · Note
• https://t.me/CVEtracker/41620 · Telegram Post
• https://twitter.com/CVEnew/status/2008959517804085637 · Twitter Post