CVE-2026-21675

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-21675
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a Use After Free vulnerability in the CIccXform::Create() function, where it deletes the hint. This issue is fixed in version 2.3.1.1.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/InternationalColorConsortium/iccDEV/commit/510baf58fa48e00ebbb5dd577f0db4af8876bb31 Patch
https://github.com/InternationalColorConsortium/iccDEV/issues/182 Issue Tracking Exploit Vendor Advisory
https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-wcwx-794g-g78f Patch Vendor Advisory
https://github.com/InternationalColorConsortium/iccDEV/issues/182 Issue Tracking Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*
History

12 Jan 2026, 21:00

Type Values Removed Values Added
CPE cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*
First Time Color
Color iccdev
References () https://github.com/InternationalColorConsortium/iccDEV/commit/510baf58fa48e00ebbb5dd577f0db4af8876bb31 - () https://github.com/InternationalColorConsortium/iccDEV/commit/510baf58fa48e00ebbb5dd577f0db4af8876bb31 - Patch
References () https://github.com/InternationalColorConsortium/iccDEV/issues/182 - () https://github.com/InternationalColorConsortium/iccDEV/issues/182 - Issue Tracking, Exploit, Vendor Advisory
References () https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-wcwx-794g-g78f - () https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-wcwx-794g-g78f - Patch, Vendor Advisory

06 Jan 2026, 19:16

Type Values Removed Values Added
References () https://github.com/InternationalColorConsortium/iccDEV/issues/182 - () https://github.com/InternationalColorConsortium/iccDEV/issues/182 -

06 Jan 2026, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-06 02:15

Updated : 2026-01-12 21:00

NVD link : CVE-2026-21675

Mitre link : CVE-2026-21675

CVE.ORG link : CVE-2026-21675

JSON object : View

Products Affected

color

  • iccdev
CWE
CWE-20

Improper Input Validation

CWE-416

Use After Free