CVE-2026-21485

8.8 HIGH

Published: January 06, 2026 Modified: January 14, 2026

Description

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are prone to have Undefined Behavior (UB) and Out of Memory errors. This issue is fixed in version 2.3.1.2.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://github.com/InternationalColorConsortium/iccDEV/commit/c136aac51d25cbb4d9db63f071edad4f088843df

Source: security-advisories@github.com

Patch

https://github.com/InternationalColorConsortium/iccDEV/issues/340

Source: security-advisories@github.com

Exploit Issue Tracking Vendor Advisory

https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-chp2-4gv5-2432

Source: security-advisories@github.com

Vendor Advisory

https://github.com/InternationalColorConsortium/iccDEV/issues/340

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Exploit Issue Tracking Vendor Advisory

4 reference(s) from NVD

Quick Stats

CVSS v3 Score

8.8 / 10.0

EPSS (Exploit Probability)

0.1%

33th percentile

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-20 CWE-125 CWE-190 CWE-400 CWE-476 CWE-787 CWE-1284

Affected Vendors

color

Related CVEs