CVE-2026-21503CWE-131CWE-20CWE-476CWE-628

iccDEV has Undefined Behavior - Null Pointer Passed to memcpy() in CIccTagSparseMatrixArray

Medium · published January 7, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
8.2
In the wild
Unconfirmed
What it is

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV has undefined behavior due to a null pointer passed to memcpy() in CIccTagSparseMatrixArray. This issue has been patched in version 2.3.1.2.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00190 · 8.2th percentile
Weaknesses
CWE-131 · Incorrect Calculation of Buffer Size; CWE-20 · Improper Input Validation; CWE-476 · NULL Pointer Dereference; CWE-628 · Function Call with Incorrectly Specified Arguments
Published
2026-01-07T17:10Z
EPSS history
Timeline
  • 07 JAN 17:10Z
    iccDEV has Undefined Behavior - Null Pointer Passed to memcpy() in CIccTagSparseMatrixArray
    cvelistv5