CVE-2026-21677CWE-20CWE-758

iccDEV has Undefined Behavior in CIccCLUT::Init()

High · published January 6, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
29.9
In the wild
Unconfirmed
What it is

⚡ A tiny glitch in ICC color management could lead to unexpected behavior! This undefined behavior in versions 2.3.1 and below of iccDEV is like a chef accidentally mixing up the recipe—what goes in may not be what comes out! 🎨 Think of it as a recipe book missing crucial steps—when a chef skips the instructions, the dish might turn out surprisingly sneaky! This bug in the CIccCLUT::Init function means that the initialized CLUT size can behave unexpectedly, leading to unpredictable outcomes in color management. With this undefined behavior, an attacker could exploit it to cause erratic behavior in applications relying on ICC profiles—think of color displays going haywire! While no known exploits are reported, the possibilities could lead to application crashes or potentially sensitive data being mishandled. That's a recipe for disaster!

Put simply

Think of it as a recipe book missing crucial steps—when a chef skips the instructions, the dish might turn out surprisingly sneaky! This bug in the CIccCLUT::Init function means that the initialized CLUT size can behave unexpectedly, leading to unpredictable outcomes in color management. This vulnerability arises in the CIccCLUT::Init function, where improper handling of color look-up tables (CLUTs) can lead to undefined behavior, potentially compromising applications that depend on accurate color management.

What to do

With this undefined behavior, an attacker could exploit it to cause erratic behavior in applications relying on ICC profiles—think of color displays going haywire! While no known exploits are reported, the possibilities could lead to application crashes or potentially sensitive data being mishandled. That's a recipe for disaster! Upgrade iccDEV to version 2.3.1.1 immediately to patch this vulnerability! Additionally, review your color management implementations to ensure stability and reliability in your applications. Don't skip this step! You’ve got this! By following these steps, you’ll keep those color profiles in check and your applications running smoothly. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00371 · 29.9th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-758 · Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
Published
2026-01-06T03:11Z
EPSS history
Timeline
  • 06 JAN 03:11Z
    iccDEV has Undefined Behavior in CIccCLUT::Init()
    cvelistv5