PT-2026-2089 · Iccdev · Iccdev

Xsscx · Published 2026-01-07 · Updated 2026-01-07 · CVE-2026-21692

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iccDEV versions prior to 2.3.1.2

Description iccDEV is a set of libraries and tools for interacting with International Color Consortium (ICC) color management profiles. A Type Confusion flaw exists in the ToXmlCurve() function located at IccXML/IccLibXML/IccMpeXml.cpp. This issue affects users of the iccDEV library when processing ICC color profiles.

Recommendations Versions prior to 2.3.1.2 should be updated to version 2.3.1.2 to address this issue.

Exploit

Fix

RCE

Type Confusion

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-20

CWE-588

CWE-843

CWE-704

Related Identifiers

CVE-2026-21692

GHSA-7662-MF46-WR88

Affected Products

Iccdev

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21692.json · Exploit
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-7662-mf46-wr88 · Vendor Advisory
• https://github.com/InternationalColorConsortium/iccDEV/issues/388 · Vendor Advisory
• https://github.com/InternationalColorConsortium/iccDEV/pull/432 · Patch
• https://osv.dev/vulnerability/CVE-2026-21692 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21692 · Security Note
• https://twitter.com/CVEnew/status/2009032512375542055 · Twitter Post
• https://twitter.com/CveFindCom/status/2009032173374799891 · Twitter Post
• https://twitter.com/TheHackerWire/status/2009028432282411224 · Twitter Post