PT-2026-2086 · Iccdev · Iccdev

Xsscx · Published 2026-01-07 · Updated 2026-01-07 · CVE-2026-21689

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions iccDEV versions prior to 2.3.1.2

Description iccDEV is a set of libraries and tools for interacting with International Color Consortium (ICC) color management profiles. A Type Confusion issue exists in the CIccProfileXml::ParseBasic() function located in IccXML/IccLibXML/IccProfileXml.cpp. This affects users who process ICC color profiles.

Recommendations Update to version 2.3.1.2 or later.

Exploit

Fix

Improper Check for Exceptional Conditions

Integer Overflow

NULL Pointer Dereference

Type Confusion

RCE

Weakness Enumeration

CWE-754

CWE-190

CWE-476

CWE-843

CWE-232

CWE-20

CWE-690

Related Identifiers

CVE-2026-21689

GHSA-5RQC-W93Q-589M

Affected Products

Iccdev

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21689.json · Exploit
• https://github.com/InternationalColorConsortium/iccDEV/issues/382 · Vendor Advisory
• https://github.com/InternationalColorConsortium/iccDEV/pull/423 · Patch
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-5rqc-w93q-589m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21689 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21689 · Vendor Advisory
• https://twitter.com/CVEnew/status/2009032516536307973 · Twitter Post