PT-2026-2066 · Iccdev · Iccdev

Xsscx · Published 2026-01-07 · Updated 2026-01-07 · CVE-2026-21500

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iccDEV versions prior to 2.3.1.2

Description iccDEV is a set of libraries and tools used for interacting with, manipulating, and applying ICC color management profiles. A stack overflow issue exists in the XML calculator macro expansion component in versions prior to 2.3.1.2.

Recommendations Update to version 2.3.1.2 or later.

Exploit

Fix

Resource Exhaustion

Memory Corruption

RCE

Uncontrolled Recursion

Weakness Enumeration

CWE-400

CWE-787

CWE-20

CWE-674

CWE-1119

Related Identifiers

CVE-2026-21500

GHSA-4H4J-MM9W-2CP4

Affected Products

Iccdev

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21500.json · Exploit
• 🔥 https://github.com/InternationalColorConsortium/iccDEV/issues/384 · Exploit
• https://github.com/InternationalColorConsortium/iccDEV/commit/cce5f9b68a6c067b7ef898ccd5b000770745fb14 · Patch
• https://github.com/InternationalColorConsortium/iccDEV/commit/f295826a6f15add90490030f23b2ddd8593bff5b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-21500 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21500 · Vendor Advisory
• https://github.com/InternationalColorConsortium/iccDEV/pull/406 · Note
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-4h4j-mm9w-2cp4 · Note
• https://t.me/CVEtracker/41622 · Telegram Post
• https://twitter.com/CVEnew/status/2008959515799244901 · Twitter Post