PT-2026-2068 · Iccdev · Iccdev

Xsscx · Published 2026-01-07 · Updated 2026-01-08 · CVE-2026-21502

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions iccDEV versions prior to 2.3.1.2

Description iccDEV is a set of libraries and tools used for interacting with, manipulating, and applying ICC color management profiles. A NULL pointer dereference issue exists in the XML tag parser in versions prior to 2.3.1.2. This issue can be triggered via the XML tag parser.

Recommendations Update to iccDEV version 2.3.1.2 or later.

Exploit

Fix

NULL Pointer Dereference

Unchecked Return Value

RCE

Weakness Enumeration

CWE-476

CWE-252

CWE-20

CWE-690

Related Identifiers

CVE-2026-21502

GHSA-67R8-Q3MH-42J6

Affected Products

Iccdev

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21502.json · Exploit
• 🔥 https://github.com/InternationalColorConsortium/iccDEV/issues/368 · Exploit
• https://github.com/InternationalColorConsortium/iccDEV/commit/d04c236775e89a029f93efcc242fdb1fbc245a1c · Patch
• https://github.com/InternationalColorConsortium/iccDEV/commit/d9e42a1fb2606e25e498eb94f34f6da89f522e35 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-21502 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21502 · Vendor Advisory
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-67r8-q3mh-42j6 · Note
• https://github.com/InternationalColorConsortium/iccDEV/pull/407 · Note
• https://twitter.com/VulmonFeeds/status/2009088521584234644 · Twitter Post
• https://t.me/CVEtracker/41624 · Telegram Post
• https://twitter.com/CVEnew/status/2008959514725474473 · Twitter Post