CVE-2026-21507CWE-835

iccDEV is Vulnerable to Denial of Service via Infinite Loop in CalcProfileID()

High · published January 6, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
36.9
In the wild
Unconfirmed
What it is

⚡ An infinite loop in color profile handling could bring your application to a grinding halt! 🖥️ Think of this vulnerability like a blender stuck in a cycle — it just keeps whirring away without producing anything useful, wasting resources while the rest of your kitchen goes unattended. An attacker could trigger this infinite loop, leading to high CPU usage and potentially crashing your application. This can result in downtime and a frustrating experience for users, all because of a sneaky bug in the color management system!

Put simply

Think of this vulnerability like a blender stuck in a cycle — it just keeps whirring away without producing anything useful, wasting resources while the rest of your kitchen goes unattended. The vulnerability resides in the CalcProfileID function of the IccProfile.cpp file in iccDEV, where the infinite loop happens due to improper handling of specific ICC profiles, allowing unbounded resource consumption.

What to do

An attacker could trigger this infinite loop, leading to high CPU usage and potentially crashing your application. This can result in downtime and a frustrating experience for users, all because of a sneaky bug in the color management system! Upgrade to version 2.3.1.1 of iccDEV immediately to close this loop and restore smooth operation. Keep an eye on your application’s performance metrics to ensure everything is running as expected post-update. You’ve got this! Fixing this vulnerability will keep your application zipping along smoothly! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00436 · 36.9th percentile
Weakness
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2026-01-06T00:11Z
EPSS history
Timeline
  • 06 JAN 00:11Z
    iccDEV is Vulnerable to Denial of Service via Infinite Loop in CalcProfileID()
    cvelistv5