CVE-2026-21485CWE-125CWE-1284CWE-190CWE-20CWE-400CWE-476CWE-787

iccDEV Undefined Behavior (UB) and Out of Memory in CIccProfile::LoadTag()

High · published January 6, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
29.9
In the wild
Unconfirmed
What it is

⚡ A tiny slip in color management can lead to undefined behavior and out-of-memory errors! Versions 2.3.1.1 and lower of iccDEV are ready for a critical fix! 🔥 Think of it like a paint shop mixing colors without checking the ingredient ratios — too much of one color can lead to a messy, unusable result. Here, the undefined behavior is like improperly mixed paint causing a chaotic canvas instead of a beautiful masterpiece. An attacker could exploit this flaw, causing applications to crash or behave unpredictably, which can be absolutely devastating for any project relying on accurate color profiles. Imagine losing access to your tools at a critical moment — that’s the risk here!

Put simply

Think of it like a paint shop mixing colors without checking the ingredient ratios — too much of one color can lead to a messy, unusable result. Here, the undefined behavior is like improperly mixed paint causing a chaotic canvas instead of a beautiful masterpiece. This vulnerability in iccDEV arises from improper handling of memory which leads to undefined behavior and out-of-memory crashes in versions 2.3.1.1 and below.

What to do

An attacker could exploit this flaw, causing applications to crash or behave unpredictably, which can be absolutely devastating for any project relying on accurate color profiles. Imagine losing access to your tools at a critical moment — that’s the risk here! To guard against this issue, swiftly upgrade to version 2.3.1.2 or later. It’s also a good idea to review your color management processes to ensure stability. Don't wait — the fix is just a version bump away! You've got this! Follow these steps and you'll be back to creating beautiful color profiles in no time. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00371 · 29.9th percentile
Weaknesses
CWE-125 · Out-of-bounds Read; CWE-1284 · Improper Validation of Specified Quantity in Input; CWE-190 · Integer Overflow or Wraparound; CWE-20 · Improper Input Validation; CWE-400 · Uncontrolled Resource Consumption; CWE-476 · NULL Pointer Dereference; CWE-787 · Out-of-bounds Write
Published
2026-01-06T03:17Z
EPSS history
Timeline
  • 06 JAN 03:17Z
    iccDEV Undefined Behavior (UB) and Out of Memory in CIccProfile::LoadTag()
    cvelistv5