CVE-2026-21486CWE-122CWE-190CWE-416CWE-787

Use After Free and Heap-based Buffer Overflow and Integer Overflow or Wraparound and Out-of-bounds Write in iccDEV

High · published January 6, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
4.9
In the wild
Unconfirmed
What it is

⚡ A heap-based buffer overflow is hiding in iccDEV's color management system, and it might just turn your color palette upside down! 🎨 Think of this vulnerability like a crowded art gallery where one visitor suddenly pushes a canvas out of the way, causing a chain reaction that knocks over an entire collection. The instability in the CIccSparseMatrix function lets an attacker manipulate memory, leading to unpredictable outcomes. An attacker could exploit this flaw to write to memory locations they shouldn't, potentially causing crashes or corruption of data. Imagine losing precious work due to a random color distortion — absolutely devastating for any graphics application! If exploited, it could lead to unauthorized actions or even system instability.

Put simply

Think of this vulnerability like a crowded art gallery where one visitor suddenly pushes a canvas out of the way, causing a chain reaction that knocks over an entire collection. The instability in the CIccSparseMatrix function lets an attacker manipulate memory, leading to unpredictable outcomes. This vulnerability arises from a Use After Free error in the CIccSparseMatrix constructor, compounded by a heap-based buffer overflow and integer overflow. When processing color profiles, the function mishandles memory allocation, leaving it open to exploitation through crafted inputs.

What to do

An attacker could exploit this flaw to write to memory locations they shouldn't, potentially causing crashes or corruption of data. Imagine losing precious work due to a random color distortion — absolutely devastating for any graphics application! If exploited, it could lead to unauthorized actions or even system instability. To secure your system, upgrade to version 2.3.1.2 immediately. Additionally, review your code for any memory handling practices that could lead to similar vulnerabilities. Regular audits can help catch these sneaky issues before they become a problem! You've got this! With these steps, you'll have your color management secured in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00161 · 4.9th percentile
Weaknesses
CWE-122 · Heap-based Buffer Overflow; CWE-190 · Integer Overflow or Wraparound; CWE-416 · Use After Free; CWE-787 · Out-of-bounds Write
Published
2026-01-06T03:36Z
EPSS history
Timeline
  • 06 JAN 03:36Z
    Use After Free and Heap-based Buffer Overflow and Integer Overflow or Wraparound and Out-of-bounds Write in iccDEV
    cvelistv5